Falhas do tipo CWE-79

28.783 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2024-3530LOWCampcodes Complete Online Student Management System Marks_view.php cross site scriptingEPSS 0.7%CVE-2023-4597MEDIUMSlimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2023-41895HIGHCross-site Scripting via auth_callback login in Home Assistant CoreEPSS 0.7%CVE-2022-4615HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 0.7%CVE-2024-34105MEDIUMStored Cross Site Scripting in Order CommentEPSS 0.7%CVE-2024-9467HIGHExpedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session DisclosureEPSS 0.7%CVE-2021-4367MEDIUMFlo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site ScriptingEPSS 0.7%CVE-2020-5339MEDIUMRSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A maliciouEPSS 0.7%CVE-2023-23277MEDIUMSnippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote attackers can render arbitrary web script or HTML from the "Snippet coEPSS 0.7%CVE-2024-1304MEDIUMMultiple Vulnerabilities in Badger Meter's MonitoolEPSS 0.7%CVE-2020-5340MEDIUMRSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A maliciouEPSS 0.7%CVE-2022-40470MEDIUMPhpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.EPSS 0.7%CVE-2024-38959MEDIUMCross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrEPSS 0.7%CVE-2022-3070MEDIUMGenerate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-45031MEDIUMApache Syncope: Stored XSS in Console and EnduserEPSS 0.7%CVE-2021-24856—Shared Files < 1.6.61 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24502—WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-29448HIGHStored DOM XSS in Pi-hole Admin Web InterfaceEPSS 0.7%CVE-2024-3110HIGHStored XSS leading to admin account takeover in mintplex-labs/anything-llmEPSS 0.7%CVE-2023-30096MEDIUMA stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HEPSS 0.7%