Falhas do tipo CWE-79

28.820 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2021-24246—WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFSEPSS 0.7%CVE-2022-1503LOWGetSimple CMS Content Module edit.php cross site scriptingEPSS 0.7%CVE-2021-24334—Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFSEPSS 0.7%CVE-2021-3862MEDIUMCross-site Scripting (XSS) - Reflected in icecoder/icecoderEPSS 0.7%CVE-2021-24386—WP SVG Images < 3.4 - Authenticated (author+) Stored XSS via SVGEPSS 0.7%CVE-2023-6790HIGHPAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceEPSS 0.7%CVE-2023-40290HIGHAn issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects IntEPSS 0.7%CVE-2021-21434LOWXSS in Survey ModuleEPSS 0.7%CVE-2022-27859MEDIUMWordPress Travel Management plugin <= 2.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.7%CVE-2022-2115—Popup Anything < 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2020-5223MEDIUMPersistent XSS vulnerability in filename of attached file in PrivateBinEPSS 0.7%CVE-2021-24208—WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)EPSS 0.7%CVE-2022-4502HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 0.7%CVE-2024-28089MEDIUMHitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panelEPSS 0.7%CVE-2022-45380MEDIUMJenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resEPSS 0.7%CVE-2021-24129—Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-1707MEDIUMGARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scriptingEPSS 0.7%CVE-2023-24686MEDIUMAn issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV filEPSS 0.7%CVE-2026-25743HIGHOpenEMR has Stored XSS in Questionnaire answersEPSS 0.7%CVE-2022-29887HIGHCross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentiEPSS 0.7%