Weaknesses of type CWE-79

28,965 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-23633MEDIUM Label Studio XSS Vulnerability on Data ImportEPSS 0.6%CVE-2023-1179LOWSourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scriptingEPSS 0.6%CVE-2021-3977MEDIUMCross-site Scripting (XSS) - Stored in invoiceninja/invoiceninjaEPSS 0.6%CVE-2023-27237MEDIUMLavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.EPSS 0.6%CVE-2023-2925LOWWebkul krayin crm Edit Person Page 2 cross site scriptingEPSS 0.6%CVE-2024-32333MEDIUMTOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.EPSS 0.6%CVE-2023-34452MEDIUMGrav vulnerable to Self Cross Site Scripting in /forgot_passwordEPSS 0.6%CVE-2016-15037LOWgo4rayyan Scumblr Task cross site scriptingEPSS 0.6%CVE-2023-5273LOWSourceCodester Best Courier Management System manage_parcel_status.php cross site scriptingEPSS 0.6%CVE-2023-1799LOWEyouCMS login.php cross site scriptingEPSS 0.6%CVE-2022-2292LOWSourceCodester Hotel Management System Room Edit Page 1 cross site scriptingEPSS 0.6%CVE-2022-2293LOWSourceCodester Simple Sales Management System create cross site scriptingEPSS 0.6%CVE-2024-1038MEDIUMBeaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site ScriptingEPSS 0.6%CVE-2023-2678LOWSourceCodester File Tracker Manager System POST Parameter save_user.php cross site scriptingEPSS 0.6%CVE-2021-34760MEDIUMCisco TelePresence Management Suite Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-0976MEDIUMWP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via pluginEPSS 0.6%CVE-2022-43332MEDIUMA cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloEPSS 0.6%CVE-2022-1945—Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2022-1393—WP Subtitle < 3.4.1 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-0386HIGHweForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via RefererEPSS 0.6%