Weaknesses of type CWE-79

28,942 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-51055MEDIUMAn issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.EPSS 0.6%CVE-2021-24423—UpdraftPlus < 1.16.59 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-1127MEDIUMCisco Enterprise NFV Infrastructure Software Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2018-3763—In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS EPSS 0.6%CVE-2023-23630HIGHCross-site (XSS) vulnerability with Express API in EtaEPSS 0.6%CVE-2022-38439MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.6%CVE-2025-4460MEDIUMTOTOLINK N150RT URL Filtering Page cross site scriptingEPSS 0.6%CVE-2023-47795CRITICALStored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DEPSS 0.6%CVE-2023-3888LOWCampcodes Beauty Salon Management System admin-profile.php cross site scriptingEPSS 0.6%CVE-2021-24481—Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24479—DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24448—Profile Builder < 3.4.8 - Authenticated Stored XSSEPSS 0.6%CVE-2022-0372HIGHCross-site Scripting (XSS) - Stored in crater-invoice/craterEPSS 0.6%CVE-2023-4635MEDIUMEventON <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2021-24519—Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2015-9104—Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticatedEPSS 0.6%CVE-2023-27925MEDIUMCross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remoteEPSS 0.6%CVE-2022-2935MEDIUMImage Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URLEPSS 0.6%CVE-2021-24343—iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-1180LOWSourceCodester Health Center Patient Record Management System hematology_print.php cross site scriptingEPSS 0.6%