Weaknesses of type CWE-79

28,640 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-11481—Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtaiEPSS 0.8%CVE-2018-3820—Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacEPSS 0.8%CVE-2024-34831MEDIUMcross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter inEPSS 0.8%CVE-2023-49657CRITICALApache Superset: Stored XSS in Dashboard Title and Chart TitleEPSS 0.8%CVE-2016-6555HIGHOpenNMS Stored XSS via SNMP Trap AlertsEPSS 0.8%CVE-2023-39510MEDIUMStored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in CactiEPSS 0.8%CVE-2023-39512MEDIUMStored Cross-site Scripting on data_sources.php device name view in CactiEPSS 0.8%CVE-2016-6556HIGHOpenNMS Stored XSS via SNMP Agent DataEPSS 0.8%CVE-2022-30577HIGHTIBCO EBX Stored XSS vulnerabilityEPSS 0.8%CVE-2022-28216—SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unautEPSS 0.8%CVE-2020-4052MEDIUMStored XSS through template injection in Wiki.jsEPSS 0.8%CVE-2024-30264HIGHtypebot.io: `GHSL-2024-040`EPSS 0.8%CVE-2022-24397—SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectEPSS 0.8%CVE-2022-20788MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-32782MEDIUMCross-Site Scripting in Nextcloud CirclesEPSS 0.8%CVE-2024-31065MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.8%CVE-2020-2005HIGHPAN-OS: GlobalProtect Clientless VPN session hijackingEPSS 0.8%CVE-2022-2140HIGHElcomplus SmartICS Cross-site ScriptingEPSS 0.8%CVE-2022-0753LOWCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 0.8%CVE-2021-32664HIGHReflected XSS in Combodo/iTopEPSS 0.8%