Weaknesses of type CWE-79

28,815 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-2390LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-4982CRITICALCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.7%CVE-2022-40287CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.EPSS 0.7%CVE-2023-4603MEDIUMStar CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2020-7574—A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.3EPSS 0.7%CVE-2023-28331MEDIUMMoodle: xss risk when outputting database activity filter dataEPSS 0.7%CVE-2023-4981HIGHCross-site Scripting (XSS) - DOM in librenms/librenmsEPSS 0.7%CVE-2023-4602MEDIUMNamaste! LMS <= 2.6.1.1 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-73031HIGHtelegram-search Stored XSS via v-html in MessageList.vueEPSS 0.7%CVE-2022-40288CRITICALStored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionalityEPSS 0.7%CVE-2022-3135MEDIUMSEO Smart Links <= 3.0.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2010-4264—It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute oEPSS 0.7%CVE-2022-2799—Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2020-5286MEDIUMReflected XSS related in import page in PrestaShopEPSS 0.7%CVE-2021-24126—Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-2887—WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2023-5024LOWPlanno Comment cross site scriptingEPSS 0.7%CVE-2022-2737—WP STAGING < 2.9.18 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-0706—Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2023-2667LOWSourceCodester Lost and Found Information System cross site scriptingEPSS 0.7%