Falhas do tipo CWE-79

29.035 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-4736LOWVenganzas del Pasado cross site scriptingEPSS 0.6%CVE-2022-4881MEDIUMCapsAdmin PAC3 http.lua cross site scriptingEPSS 0.6%CVE-2022-4235MEDIUMRushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible EPSS 0.6%CVE-2024-25327MEDIUMCross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code viEPSS 0.6%CVE-2023-40592HIGHReflected Cross-site Scripting (XSS) on "/app/search/table" web endpointEPSS 0.6%CVE-2023-4945MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-2146LOWSourceCodester Online Mobile Management Store ?p=products cross site scriptingEPSS 0.6%CVE-2023-52046MEDIUMCross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted paylEPSS 0.6%CVE-2021-37374MEDIUMCross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the FriendlEPSS 0.6%CVE-2022-36432MEDIUMThe Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-siteEPSS 0.6%CVE-2021-36889LOWWordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2020-20521MEDIUMCross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.EPSS 0.6%CVE-2021-41836MEDIUMFathom Analytics <= 3.0.4 Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-66395CRITICALSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan ProtocolEPSS 0.6%CVE-2020-20070MEDIUMCross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameteEPSS 0.6%CVE-2022-37421MEDIUMSilverstripe silverstripe/cms through 4.11.0 allows XSS.EPSS 0.6%CVE-2023-3445LOWCross-site Scripting (XSS) - Stored in spinacms/spinaEPSS 0.6%CVE-2022-27848LOWWordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-34658MEDIUMWordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2026-68534LOWConcrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectorsEPSS 0.6%