Weaknesses of type CWE-79

28,747 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-0698MEDIUMMicroweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.EPSS 0.7%CVE-2021-36845MEDIUMYITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.7%CVE-2026-86712HIGHSiYuan before 3.8.2 Remote Code Execution via ClipboardEPSS 0.7%CVE-2023-3837LOWDedeBIZ sys_sql_query.php cross site scriptingEPSS 0.7%CVE-2023-42458LOWZope vulnerable to Stored Cross Site Scripting with SVG imagesEPSS 0.7%CVE-2022-1255—Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-38162MEDIUMReflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an uEPSS 0.7%CVE-2024-1970MEDIUMSourceCodester Online Learning System V2 index.php cross site scriptingEPSS 0.7%CVE-2021-25983MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories FunctionalityEPSS 0.7%CVE-2021-25984MEDIUMFactorJS - Stored Cross-Site Scripting (XSS) in Post Reply FunctionalityEPSS 0.7%CVE-2023-34464CRITICALXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent templateEPSS 0.7%CVE-2023-0513LOWisoftforce Dreamer CMS cross site scriptingEPSS 0.7%CVE-2024-27524HIGHCross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the fileEPSS 0.7%CVE-2023-0740HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.7%CVE-2022-43760HIGHAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some hEPSS 0.7%CVE-2024-29203MEDIUMTinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesEPSS 0.7%CVE-2024-29881MEDIUMTinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsEPSS 0.7%CVE-2024-28740MEDIUMCross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contentEPSS 0.7%CVE-2024-34452MEDIUMCMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.EPSS 0.7%CVE-2024-32970HIGHCross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in PhlexEPSS 0.7%