Weaknesses of type CWE-79

28,831 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-1568LOWSourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2021-24250—Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-32173—OrchardCore - HTML InjectionEPSS 0.6%CVE-2022-48326MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parametEPSS 0.6%CVE-2023-0106CRITICALCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-41330HIGHAn improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7EPSS 0.6%CVE-2022-40313HIGHRecursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to loadEPSS 0.6%CVE-2024-57030HIGHWegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.EPSS 0.6%CVE-2023-20133MEDIUMA vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scEPSS 0.6%CVE-2020-5346MEDIUMRSA Authentication Manager versions prior to 8.4 P11 contain a stored cross-site scripting vulnerability in the Security Console. A maliciouEPSS 0.6%CVE-2024-3531LOWCampcodes Complete Online Student Management System courses_view.php cross site scriptingEPSS 0.6%CVE-2019-15607—A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of ThEPSS 0.6%CVE-2023-2076LOWCampcodes Online Traffic Offense Management System Users.phpp cross site scriptingEPSS 0.6%CVE-2022-1932—Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-ScriptingEPSS 0.6%CVE-2023-43344MEDIUMCross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scrEPSS 0.6%CVE-2022-48111MEDIUMA cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackerEPSS 0.6%CVE-2022-39049LOWPossible XSS in Admin InterfaceEPSS 0.6%CVE-2026-73043CRITICALSiYuan before v3.7.4 Remote Code Execution via Template CalculationEPSS 0.6%CVE-2021-24622—WP Ticket < 5.10.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-0726MEDIUMProject Worlds Student Project Allocation System Admin Login Module admin_login.php cross site scriptingEPSS 0.6%