Weaknesses of type CWE-79

28,833 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-38145MEDIUMSilverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's metaEPSS 0.6%CVE-2023-40577HIGHAlertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointEPSS 0.6%CVE-2020-8280—A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scriptiEPSS 0.6%CVE-2021-34625MEDIUMWP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0159HIGHCross-site Scripting (XSS) - Stored in orchardcms/orchardcoreEPSS 0.6%CVE-2023-28332—Moodle: algebra filter xss when filter is misconfiguredEPSS 0.6%CVE-2022-1980LOWSourceCodester Product Show Room Site cross site scriptingEPSS 0.6%CVE-2024-29644MEDIUMCross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script EPSS 0.6%CVE-2022-36347MEDIUMWordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-21325MEDIUMStored XSS in budget typeEPSS 0.6%CVE-2021-4132HIGHCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2021-3043HIGHPrisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web ConsoleEPSS 0.6%CVE-2022-3000MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-46332CRITICALProofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"EPSS 0.6%CVE-2026-84108HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.6%CVE-2022-4698MEDIUMProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form SettingsEPSS 0.6%CVE-2022-3005MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-3004MEDIUMCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.6%CVE-2022-0387MEDIUMCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2024-0345MEDIUMCodeAstro Vehicle Booking System User Registration usr-register.php cross site scriptingEPSS 0.6%