Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-35222HIGHResource.aspx Reflected Cross-Site Scripting VulnerabilityEPSS 2.6%CVE-2021-45229—Apache Airflow: Reflected XSS via Origin Query Argument in URLEPSS 2.6%CVE-2020-27224—In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.EPSS 2.6%CVE-2021-24407—Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)EPSS 2.6%CVE-2022-35155MEDIUMBus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.EPSS 2.6%CVE-2020-36510—15Zine < 3.3.0 - Reflected Cross-Site ScriptingEPSS 2.6%CVE-2023-31698MEDIUMBludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that userEPSS 2.6%CVE-2019-6528—PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4EPSS 2.6%CVE-2021-42357—DOM based XSS Vulnerability in Apache KnoxEPSS 2.6%CVE-2020-24445CRITICALCross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM)EPSS 2.6%CVE-2023-25440MEDIUMStored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code EPSS 2.5%CVE-2023-4111MEDIUMPHP Jabbers Bus Reservation System index.php cross site scriptingEPSS 2.5%CVE-2024-2068LOWSourceCodester Computer Inventory System update-computer.php cross site scriptingEPSS 2.5%CVE-2021-32989CRITICALLCDS LAquis SCADA - Cross-site ScriptingEPSS 2.5%CVE-2023-0586MEDIUMAll in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 2.5%CVE-2021-3694HIGHCross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmbEPSS 2.5%CVE-2019-3826MEDIUMA stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincEPSS 2.5%CVE-2026-4354MEDIUMTRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scriptingEPSS 2.5%CVE-2021-24351—The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)EPSS 2.5%CVE-2023-4451MEDIUMCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitEPSS 2.5%