Falhas do tipo CWE-79

28.643 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-42097MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .EPSS 0.8%CVE-2021-24362—Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVGEPSS 0.8%CVE-2021-24588—SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingEPSS 0.8%CVE-2021-24798—WP Header Images < 2.0.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24679—Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24373—WP Hardening < 1.2.2 - Reflected XSS via historyvalueEPSS 0.8%CVE-2021-24676—Better Find and Replace < 1.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24368—Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24437—Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24372—WP Hardening < 1.2.2 - Reflected XSS via URIEPSS 0.8%CVE-2024-40576MEDIUMCross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "HoEPSS 0.8%CVE-2021-24290—Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2026-41098HIGHAzure Stack Edge Spoofing VulnerabilityEPSS 0.8%CVE-2023-22425MEDIUMStored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacEPSS 0.8%CVE-2023-53689MEDIUMNagios Fusion < 4.2.0 License Information Reflected XSSEPSS 0.8%CVE-2021-32683HIGHXSS through createObjectURLEPSS 0.8%CVE-2024-55224CRITICALAn HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload iEPSS 0.8%CVE-2017-6053—A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JEPSS 0.8%CVE-2024-54032CRITICALAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.8%CVE-2020-27219—In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe EPSS 0.8%