Weaknesses of type CWE-79

28,941 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24927—My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-1241HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.6%CVE-2023-45818MEDIUMCross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave pluginEPSS 0.6%CVE-2021-24443—Youzify < 1.0.7 - Stored Cross-Site Scripting via BiographyEPSS 0.6%CVE-2023-22722MEDIUMglpi subject to Cross-site Scripting (XSS) - Reflected EPSS 0.6%CVE-2022-3896MEDIUMWP Affiliate Platform <= 6.3.9 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-25602CRITICALStored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsuEPSS 0.6%CVE-2024-3004LOWcode-projects Online Book System Product.php cross site scriptingEPSS 0.6%CVE-2022-0510MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.6%CVE-2020-35740HIGHHGiga MailSherlock - XSS -1EPSS 0.6%CVE-2022-0941HIGHStored XSS due to Unrestricted File Upload in star7th/showdocEPSS 0.6%CVE-2020-35741HIGHHGiga MailSherlock - XSS -2EPSS 0.6%CVE-2022-23461MEDIUMCross-Site Scripting (XSS) in Jodit EditorEPSS 0.6%CVE-2022-0822MEDIUMCross-site Scripting (XSS) - Reflected in orchardcms/orchardcoreEPSS 0.6%CVE-2023-3787LOWCodecanyon Tiva Events Calender cross site scriptingEPSS 0.6%CVE-2020-26221HIGHStored Cross Site Scripting in touchbase.aiEPSS 0.6%CVE-2023-44852HIGHCross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafteEPSS 0.6%CVE-2023-27624MEDIUMWordPress Redirect After Login Plugin <= 0.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.6%CVE-2023-3989LOWSourceCodester Jewelry Store System add_customer.php cross site scriptingEPSS 0.6%CVE-2022-0348MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%