Weaknesses of type CWE-79

28,942 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-51337LOWCross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive informatioEPSS 0.6%CVE-2022-1094MEDIUMAmr Users < 4.59.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-52763MEDIUMA cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to executeEPSS 0.6%CVE-2023-51802MEDIUMCross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code viEPSS 0.6%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.6%CVE-2022-22126MEDIUMOpenmct XSS via the “Web Page” elementEPSS 0.6%CVE-2022-23065MEDIUMVendure - XSS via SVG File UploadEPSS 0.6%CVE-2021-1239MEDIUMCisco Firepower Management Center Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2024-28436MEDIUMCross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAEPSS 0.6%CVE-2021-25989MEDIUMifme - Stored Cross-Site Scripting (XSS) in Groups sectionEPSS 0.6%CVE-2023-4432HIGHCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitEPSS 0.6%CVE-2022-23054MEDIUMOpenmct XSS via the “Summary Widget”EPSS 0.6%CVE-2022-23053MEDIUMOpenmct XSS via the “Condition Widget”EPSS 0.6%CVE-2022-34297MEDIUMYii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.EPSS 0.6%CVE-2023-23630HIGHCross-site (XSS) vulnerability with Express API in EtaEPSS 0.6%CVE-2021-24423—UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-1127MEDIUMCisco Enterprise NFV Infrastructure Software Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-51055MEDIUMAn issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.EPSS 0.6%CVE-2022-2710—Scroll To Top < 1.4.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2567—Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%