Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2018-0403—Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenEPSS 2.7%CVE-2018-25080LOWMobileDetect Example session_example.php initLayoutType cross site scriptingEPSS 2.7%CVE-2025-47851MEDIUMIn JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleEPSS 2.6%CVE-2022-2846MEDIUMCalendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSSEPSS 2.6%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.6%CVE-2022-22242MEDIUMJunos OS: Cross-site Scripting (XSS) vulnerability in J-WebEPSS 2.6%CVE-2021-34620HIGHCSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege EscalationEPSS 2.6%CVE-2022-25370—Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizEPSS 2.6%CVE-2022-47877CRITICALA Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in tEPSS 2.6%CVE-2023-23286MEDIUMCross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via usernaEPSS 2.6%CVE-2023-23075MEDIUMCross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.EPSS 2.6%CVE-2021-35222HIGHResource.aspx Reflected Cross-Site Scripting VulnerabilityEPSS 2.6%CVE-2021-45229—Apache Airflow: Reflected XSS via Origin Query Argument in URLEPSS 2.6%CVE-2022-0087HIGHCross-site Scripting (XSS) - Reflected in keystonejs/keystoneEPSS 2.6%CVE-2020-27224—In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.EPSS 2.6%CVE-2021-24407—Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)EPSS 2.6%CVE-2020-36510—15Zine < 3.3.0 - Reflected Cross-Site ScriptingEPSS 2.6%CVE-2019-3826MEDIUMA stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincEPSS 2.6%CVE-2019-6528—PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4EPSS 2.6%CVE-2021-42357—DOM based XSS Vulnerability in Apache KnoxEPSS 2.6%