Weaknesses of type CWE-79

28,647 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-20183—It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of searchEPSS 0.8%CVE-2026-92985HIGHSiYuan before 3.8.4 Cross-Site Scripting via Bookmark LabelsEPSS 0.8%CVE-2026-92986HIGHSiYuan before 3.8.4 Cross-Site Scripting via Document TitleEPSS 0.8%CVE-2021-31851MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2022-3144MEDIUMWordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2024-27914MEDIUMReflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPIEPSS 0.8%CVE-2023-23921—Moodle: reflected xss risk in some returnurl parametersEPSS 0.8%CVE-2024-52770CRITICALAn arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary cEPSS 0.8%CVE-2022-2092—WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-56156MEDIUMHalo Vulnerable to Stored XSS and RCE via File Upload BypassEPSS 0.8%CVE-2022-0253HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.8%CVE-2021-1395MEDIUMCisco Unified Intelligence Center Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-31852MEDIUMCross-Site Scripting vulnerability in Policy AuditorEPSS 0.8%CVE-2022-25929MEDIUMCross-site Scripting (XSS)EPSS 0.8%CVE-2020-28210MEDIUMA CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building OpeEPSS 0.8%CVE-2024-26521MEDIUMHTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, andEPSS 0.8%CVE-2021-21541MEDIUMDell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker couldEPSS 0.8%CVE-2021-1575MEDIUMCisco Virtualized Voice Browser Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-2022CRITICALCross-site Scripting (XSS) - Stored in nocodb/nocodbEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%