Weaknesses of type CWE-79

28,643 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-3463MEDIUMCisco Webex Meetings Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2015-9056—Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.EPSS 0.8%CVE-2018-4842—A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNEPSS 0.8%CVE-2022-2829HIGHCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.8%CVE-2021-3879MEDIUMCross-site Scripting (XSS) - Stored in snipe/snipe-itEPSS 0.8%CVE-2022-2925CRITICALCross-site Scripting (XSS) - Stored in appwrite/appwriteEPSS 0.8%CVE-2024-36115HIGHStored Cross site scripting in Reposilite artifactsEPSS 0.8%CVE-2022-39324MEDIUMGrafana vulnerable to spoofing originalUrl of snapshotsEPSS 0.8%CVE-2023-0488CRITICALCross-site Scripting (XSS) - Stored in pyload/pyloadEPSS 0.8%CVE-2022-22125MEDIUMHalo CMS - Stored Cross-Site Scripting (XSS) in Article's TagEPSS 0.8%CVE-2020-2017HIGHPAN-OS: DOM-Based cross site scripting vulnerability in management web interfaceEPSS 0.8%CVE-2022-23515MEDIUMImproper neutralization of data URIs may allow XSS in LoofahEPSS 0.8%CVE-2021-24372—WP Hardening < 1.2.2 - Reflected XSS via URIEPSS 0.8%CVE-2021-24438—ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24679—Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24588—SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingEPSS 0.8%CVE-2021-24496—Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24368—Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24676—Better Find and Replace < 1.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24697—Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingEPSS 0.8%