Weaknesses of type CWE-79

28,647 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-0858MEDIUMCross-site scripting vulnerability in ePOEPSS 0.8%CVE-2021-31848HIGHData Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)EPSS 0.8%CVE-2022-20959MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-44897MEDIUMA cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web sEPSS 0.8%CVE-2022-41391CRITICALOcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.EPSS 0.8%CVE-2024-50861MEDIUMThe ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG KeyEPSS 0.8%CVE-2019-1838MEDIUMCisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-36416MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.8%CVE-2021-4222—WP Paginate < 2.1.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-38467MEDIUMWordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2021-29104MEDIUMThere is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.EPSS 0.8%CVE-2021-25024—Event Calendar < 1.1.51 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-33326MEDIUMA cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to eEPSS 0.8%CVE-2021-24923—Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSSEPSS 0.8%CVE-2017-16774MEDIUMCross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 EPSS 0.8%CVE-2020-5269MEDIUMReflected XSS on AdminFeatures page of PrestaShopEPSS 0.8%CVE-2026-45644HIGHMicrosoft Live Share Canvas SDK Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2021-4170HIGHCross-site Scripting (XSS) - Stored in janeczku/calibre-webEPSS 0.8%CVE-2020-5278MEDIUMReflected XSS on Exception page of PrestaShopEPSS 0.8%CVE-2020-5276MEDIUMReflected XSS on AdminCarts page of PrestaShopEPSS 0.8%