Weaknesses of type CWE-79

28,831 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-4979MEDIUMSitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSSEPSS 0.6%CVE-2024-34081MEDIUMMantisBT Cross-site Scripting vulnerabilityEPSS 0.6%CVE-2013-10010MEDIUMzerochplus thread.res.pl PrintResList cross site scriptingEPSS 0.6%CVE-2023-43874MEDIUMMultiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted scriptEPSS 0.6%CVE-2021-24920—StatCounter < 2.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0360—WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2018-3823—X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions couEPSS 0.6%CVE-2024-2553LOWSourceCodester Product Review Rating System Rate Product cross site scriptingEPSS 0.6%CVE-2022-38754HIGHCVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)EPSS 0.6%CVE-2023-1988LOWSourceCodester Online Computer and Laptop Store cross site scriptingEPSS 0.6%CVE-2023-1568LOWSourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2024-36676HIGHIncorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification emEPSS 0.6%CVE-2021-43817HIGHReflected Cross-Site-Scripting vulnerability in Collabora OnlineEPSS 0.6%CVE-2020-7576—A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter EEPSS 0.6%CVE-2021-24982—Child Theme Generator <= 2.2.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-12530MEDIUMAn issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in tEPSS 0.6%CVE-2019-16772LOWregular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-jsEPSS 0.6%CVE-2026-15780HIGHWP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterEPSS 0.6%CVE-2020-36607MEDIUMCross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tEPSS 0.6%CVE-2023-2305MEDIUMDownload Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%