Weaknesses of type CWE-79

28,647 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-56355MEDIUMIn JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSSEPSS 0.8%CVE-2019-12705MEDIUMCisco Expressway Series and TelePresence Video Communication Server Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-15231CRITICALCross-site scripting attack in mapfish-printEPSS 0.8%CVE-2019-15969MEDIUMCisco Web Security Appliance Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-56352MEDIUMIn JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pageEPSS 0.8%CVE-2023-23927MEDIUMCraft CMS stored cross-site scripting vulnerabilityEPSS 0.8%CVE-2019-16024MEDIUMCisco Crosswork Change Automation Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3282MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2018-0465—Cisco Small Business 300 Series Managed Switches Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3159MEDIUMCisco Finesse Web-Based Management Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3192MEDIUMCisco Prime Collaboration Provisioning Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3356MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-15973MEDIUMCisco Industrial Network Director Reflected Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-3313MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-15994MEDIUMCisco Stealthwatch Enterprise Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-12718MEDIUMCisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2021-25040—Booking Calendar < 8.9.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2025-46199CRITICALCross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the formEPSS 0.8%CVE-2022-0620—Delete Old Orders <= 0.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-0641—Popup Like box < 3.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%