Weaknesses of type CWE-79

28,777 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-45836HIGHWordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)EPSS 0.7%CVE-2023-45815MEDIUMArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins contextEPSS 0.7%CVE-2023-24896MEDIUMDynamics 365 Finance Spoofing VulnerabilityEPSS 0.7%CVE-2024-48120MEDIUMX2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript cEPSS 0.7%CVE-2026-52760MEDIUMApache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web ConsoleEPSS 0.7%CVE-2021-24196—Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-4672MEDIUMCampcodes Complete Web-Based School Management System show_student_subject.php cross site scriptingEPSS 0.7%CVE-2023-4774MEDIUMWP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2022-4697MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-0614MEDIUMEvents Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settingsEPSS 0.7%CVE-2023-7133MEDIUMy_project RuoYi HTTP POST Request login cross site scriptingEPSS 0.7%CVE-2023-6774MEDIUMCodeAstro POS and Inventory Management System register_account cross site scriptingEPSS 0.7%CVE-2026-42253MEDIUMApache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message PropertiesEPSS 0.7%CVE-2018-0408—A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatEPSS 0.7%CVE-2018-0407—A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticatEPSS 0.7%CVE-2021-43776HIGHXSS vulnerability in @backstage/plugin-auth-backendEPSS 0.7%CVE-2022-40748MEDIUMIBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.7%CVE-2022-2065HIGHCross-site Scripting (XSS) - Stored in neorazorx/facturascriptsEPSS 0.7%CVE-2022-35721MEDIUMIBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaSEPSS 0.7%CVE-2022-1997HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.7%