Weaknesses of type CWE-79

28,640 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-10015MEDIUMConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type ParameterEPSS 0.8%CVE-2022-1474—WP Event Manager < 3.1.28 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1604—MailerLite < 1.5.4 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1527—WP 2FA < 2.2.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2020-25158HIGHB. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusEPSS 0.8%CVE-2020-8288—The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `valuEPSS 0.8%CVE-2021-22936—A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticaEPSS 0.8%CVE-2026-42090CRITICALNotesnook: RCE via stored XSS in note export renderingEPSS 0.8%CVE-2022-29876HIGHA vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parEPSS 0.8%CVE-2022-0575MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.8%CVE-2022-1267—BMI BMR Calculator <= 1.3 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-4210MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfEPSS 0.8%CVE-2022-4208MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefEPSS 0.8%CVE-2022-4212MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfEPSS 0.8%CVE-2022-4209MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfEPSS 0.8%CVE-2022-0589MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.8%CVE-2020-5272MEDIUMReflected XSS on Search page of PrestaShopEPSS 0.8%CVE-2022-1380CRITICALStored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-itEPSS 0.8%CVE-2022-4211MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfEPSS 0.8%CVE-2024-2630MEDIUMInappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.8%