Weaknesses of type CWE-79

28,777 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-2072—Name Directory < 1.25.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2022-0684—WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-42118HIGHStored XSS in TopEaseEPSS 0.7%CVE-2022-2181—Advanced WordPress Reset < 1.6 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2022-37342MEDIUMWordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2022-35697MEDIUMAEM File Upload Security Issue leading to RXSSEPSS 0.7%CVE-2024-0650MEDIUMProject Worlds Visitor Management System URL dataset.php cross site scriptingEPSS 0.7%CVE-2021-22540—XSS in Dart SDKEPSS 0.7%CVE-2022-2256—A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privilegeEPSS 0.7%CVE-2022-2646LOWSourceCodester Online Admission System index.php cross site scriptingEPSS 0.7%CVE-2021-32542MEDIUMSysJust CTS Web - Reflected XSSEPSS 0.7%CVE-2024-28150MEDIUMJenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frEPSS 0.7%CVE-2023-26777MEDIUMCross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commandEPSS 0.7%CVE-2022-0145MEDIUMCross-site Scripting (XSS) - Stored in forkcms/forkcmsEPSS 0.7%CVE-2023-5701MEDIUMvnotex vnote Markdown File cross site scriptingEPSS 0.7%CVE-2022-31057MEDIUMAuthenticated Stored XSS in Shopware AdministrationEPSS 0.7%CVE-2023-24896MEDIUMDynamics 365 Finance Spoofing VulnerabilityEPSS 0.7%CVE-2023-29714MEDIUMCross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, passworEPSS 0.7%CVE-2024-0598MEDIUMGutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message SettingsEPSS 0.7%CVE-2023-29713MEDIUMCross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to EPSS 0.7%