Falhas do tipo CWE-79

28.489 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-1439MEDIUMReflected XSS on demo.microweber.org/demo/module/ in microweber/microweberEPSS 3.3%CVE-2021-24308—LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit ProfileEPSS 3.2%CVE-2022-0683MEDIUMEssential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site ScriptingEPSS 3.2%CVE-2020-16206—The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain acEPSS 3.2%CVE-2020-16210—The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perEPSS 3.2%CVE-2022-0954MEDIUMMultiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweberEPSS 3.2%CVE-2021-35229MEDIUMCross-Site Scripting Vulnerability using SQL QueryEPSS 3.2%CVE-2021-29460HIGHCross-site scripting (XSS) from unsanitized uploaded SVG filesEPSS 3.2%CVE-2021-3693HIGHCross-site Scripting (XSS) - DOM in ledgersmb/ledgersmbEPSS 3.2%CVE-2021-37216MEDIUMQSAN Storage Manager - Reflected Cross-Site ScriptingEPSS 3.2%CVE-2022-2130MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 3.1%CVE-2021-24884—Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site ScriptingEPSS 3.1%CVE-2022-0225—A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new groEPSS 3.1%CVE-2021-32853MEDIUMErxes vulnerable to Cross-site ScriptingEPSS 3.1%CVE-2019-15253MEDIUMCisco Digital Network Architecture Center Stored Cross-Site Scripting VulnerabilityEPSS 3.1%CVE-2022-41358MEDIUMA stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTMLEPSS 3.1%CVE-2023-4117MEDIUMPHP Jabbers Rental Property Booking index.php cross site scriptingEPSS 3.1%CVE-2022-28712CRITICALA cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A speEPSS 3.1%CVE-2022-1153—LayerSlider < 7.1.2 - Admin+ Stored Cross-Site ScriptingEPSS 3.1%CVE-2023-23956MEDIUMA user can supply malicious HTML and JavaScript code that will be executed in the client browserEPSS 3.1%