Weaknesses of type CWE-79

28,642 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-3346MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-25006—MOLIE <= 0.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2020-3551MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-26256MEDIUMWordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2020-13176—The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 EPSS 0.8%CVE-2024-43687HIGHXSS vulnerability in bannerconfig endpoint in TimeProvider 4100EPSS 0.8%CVE-2020-3599MEDIUMCisco Adaptive Security Appliance Software Web-Based Management Interface Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-40111MEDIUMA persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an aEPSS 0.8%CVE-2023-7108MEDIUMcode-projects E-Commerce Website user_signup.php cross site scriptingEPSS 0.8%CVE-2022-23713—A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to beEPSS 0.8%CVE-2022-3709MEDIUMA stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases EPSS 0.8%CVE-2024-4041MEDIUMYoast SEO <= 22.5 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-21650HIGHStored XSS via html file upload in convosEPSS 0.8%CVE-2024-35236MEDIUMAudiobookshelf Cross-Site-Scripting vulnerability via crafted ebooksEPSS 0.8%CVE-2020-6973—Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vEPSS 0.8%CVE-2023-22427MEDIUMStored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker witEPSS 0.8%CVE-2022-32247—SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unautheEPSS 0.8%CVE-2023-24814HIGHPersisted Cross-Site Scripting in Frontend Rendering in typo3EPSS 0.8%CVE-2021-32812MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.jsEPSS 0.8%CVE-2020-3463MEDIUMCisco Webex Meetings Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%