Falhas do tipo CWE-79

28.384 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2022-28290—Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the userEPSS 1.4%CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%CVE-2023-26842MEDIUMA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the EPSS 1.4%CVE-2021-24934—Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2019-16781MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.4%CVE-2022-4092MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious REAEPSS 1.4%CVE-2022-0385—Crazy Bone <= 0.6.0 - Unauthenticated Stored XSSEPSS 1.4%CVE-2024-26251MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.4%CVE-2023-35393MEDIUMAzure Apache Hive Spoofing VulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2021-3486—GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.EPSS 1.4%CVE-2024-12641CRITICALChunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCEEPSS 1.4%CVE-2020-10688—A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haEPSS 1.4%CVE-2021-24241—Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.4%CVE-2021-32862HIGHnbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsEPSS 1.4%CVE-2024-53442CRITICALwhapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.EPSS 1.4%CVE-2022-46769MEDIUMApache Sling App CMS: XSS in CMS Site Group DetailEPSS 1.4%CVE-2019-14863HIGHThere is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appliEPSS 1.4%CVE-2021-28807HIGHPost-Authentication Reflected XSS Vulnerability in Q'centerEPSS 1.4%