Weaknesses of type CWE-79

28,778 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-35131MEDIUMMoodle: xss risk on groups pageEPSS 0.7%CVE-2023-43343MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.7%CVE-2024-24506MEDIUMCross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrEPSS 0.7%CVE-2022-35721MEDIUMIBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaSEPSS 0.7%CVE-2019-10146MEDIUMA Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service EPSS 0.7%CVE-2022-2374—Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2020-13672—Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circuEPSS 0.7%CVE-2022-1997HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.7%CVE-2024-34120MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2022-1590LOWBludit New Content Module new-content cross site scriptingEPSS 0.7%CVE-2024-36142MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-26121MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2021-24616—AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24598—Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-26117MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.7%CVE-2024-26085MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2024-10234MEDIUMWildfly: wildfly vulnerable to cross-site scripting (xss)EPSS 0.7%CVE-2021-24658—Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-26123MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.7%CVE-2021-24574—Simple Banner < 2.10.4 - Authenticated Stored XSSEPSS 0.7%