Weaknesses of type CWE-79

28,943 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6466LOWThecosy IceCMS User Comment planet cross site scriptingEPSS 0.6%CVE-2024-4726MEDIUMCampcodes Legal Case Management System clients cross site scriptingEPSS 0.6%CVE-2023-6896LOWSourceCodester Simple Image Stack Website cross site scriptingEPSS 0.6%CVE-2024-5123MEDIUMSourceCodester Event Registration System cross site scriptingEPSS 0.6%CVE-2024-4731MEDIUMCampcodes Legal Case Management System role cross site scriptingEPSS 0.6%CVE-2023-23010MEDIUMCross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27,EPSS 0.6%CVE-2018-10854MEDIUMcloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastEPSS 0.6%CVE-2024-4521LOWCampcodes Complete Web-Based School Management System teacher_salary_details2.php cross site scriptingEPSS 0.6%CVE-2024-27092MEDIUMContent spoofing - real Hoppscotch emailsEPSS 0.6%CVE-2024-1099LOWRebuild read-raw getFileOfData cross site scriptingEPSS 0.6%CVE-2023-6462LOWSourceCodester User Registration and Login System delete-user.php cross site scriptingEPSS 0.6%CVE-2023-6300LOWSourceCodester Best Courier Management System cross site scriptingEPSS 0.6%CVE-2024-4736MEDIUMCampcodes Legal Case Management System tax cross site scriptingEPSS 0.6%CVE-2023-6301LOWSourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scriptingEPSS 0.6%CVE-2024-4730MEDIUMCampcodes Legal Case Management System judge cross site scriptingEPSS 0.6%CVE-2023-6616LOWSourceCodester Simple Student Attendance System index.php cross site scriptingEPSS 0.6%CVE-2023-50883MEDIUMONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escapeEPSS 0.6%CVE-2024-51379HIGHStored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the stuEPSS 0.6%CVE-2024-4523LOWCampcodes Complete Web-Based School Management System teacher_attendance_history1.php cross site scriptingEPSS 0.6%CVE-2021-24965—Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%