Weaknesses of type CWE-79

28,781 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-22971MEDIUMCross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HNEPSS 0.7%CVE-2022-1512—ScrollReveal.js Effects <= 1.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2020-36644LOWjamesmartin Inline SVG URL Parameter helpers.rb cross site scriptingEPSS 0.7%CVE-2021-24346—Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-24918—Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSSEPSS 0.7%CVE-2022-2040—Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element URLEPSS 0.7%CVE-2022-2041—Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element ContentEPSS 0.7%CVE-2021-25061—WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2024-52809MEDIUMCross-site Scripting vulnerability with prototype pollution in vue-i18nEPSS 0.7%CVE-2021-24911—Transposh WordPress Translation < 1.0.8 - Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2020-29028MEDIUMReflected XSS issuesEPSS 0.7%CVE-2024-28434HIGHThe CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the exEPSS 0.7%CVE-2019-18588CRITICALDell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMaxEPSS 0.7%CVE-2023-0650LOWYAFNET Signature cross site scriptingEPSS 0.7%CVE-2022-2291MEDIUMSourceCodester Hotel Management System Search search cross site scriptingEPSS 0.7%CVE-2022-31148MEDIUMPersistent cross site scripting in customer module in ShopwareEPSS 0.7%CVE-2020-26205HIGHXSS in SalEPSS 0.7%CVE-2026-0535HIGHStored XSS in Electronic Library Component DescriptionEPSS 0.7%CVE-2023-34666MEDIUMCross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web scriEPSS 0.7%