Falhas do tipo CWE-79

29.274 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2023-0364—real.Kit < 5.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-0064—eVision Responsive Column Layout Shortcodes <= 2.3 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-45849MEDIUMWordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-4749MEDIUMPosts List Designer by Category < 3.2 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2023-0145—Saan World Clock <= 1.8 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-0097MEDIUMPost Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-20868MEDIUMNSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScEPSS 0.5%CVE-2024-8738MEDIUMSeriously Simple Stats <= 1.6.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-4754—Easy Social Box <= 4.1.2 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2023-49986MEDIUMA cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute arEPSS 0.5%CVE-2024-0665MEDIUMWP Customer Area <= 8.2.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2021-4116MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.5%CVE-2022-4777—Bootstrap Shortcodes <= 3.4.0 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2022-4786MEDIUMVideo.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2022-26866MEDIUMDell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potEPSS 0.5%CVE-2023-46251HIGHVisual editor persistent Cross-site Scripting (XSS) in MyBBEPSS 0.5%CVE-2023-0365—React Webcam <= 1.2.0 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-0068—Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2023-4196HIGHCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitEPSS 0.5%CVE-2024-48284MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login anEPSS 0.5%