Weaknesses of type CWE-79

28,675 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-22706—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22PEPSS 0.8%CVE-2021-39314MEDIUMWooCommerce EnvioPack <= 1.2 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-39319MEDIUMduoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-52860MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.8%CVE-2021-25000—Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General ModuleEPSS 0.8%CVE-2021-39310MEDIUMReal WYSIWYG <= 0.0.2 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-36895MEDIUMWordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image uploadEPSS 0.8%CVE-2021-25982MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Search FunctionalityEPSS 0.8%CVE-2024-57428CRITICALA stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fiEPSS 0.8%CVE-2021-25001—Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds ModuleEPSS 0.8%CVE-2021-39311MEDIUMlink-list-manager <= 1.0 Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-29415MEDIUMWordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2017-0923—Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent crEPSS 0.8%CVE-2017-0924—Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross siteEPSS 0.8%CVE-2023-46134MEDIUMD-Tale vulnerable to Remote Code Execution through the Custom Filter InputEPSS 0.8%CVE-2021-44053MEDIUMReflected XSSEPSS 0.8%CVE-2022-20815MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2022-20800MEDIUMCisco Unified Communications Products Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-21690HIGHThis High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0EPSS 0.8%CVE-2020-5264MEDIUMReflected XSS in security compromised page of PrestaShopEPSS 0.8%