Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-42094MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.EPSS 2.6%CVE-2020-24445CRITICALCross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM)EPSS 2.6%CVE-2023-25440MEDIUMStored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code EPSS 2.5%CVE-2023-4111MEDIUMPHP Jabbers Bus Reservation System index.php cross site scriptingEPSS 2.5%CVE-2024-2068LOWSourceCodester Computer Inventory System update-computer.php cross site scriptingEPSS 2.5%CVE-2022-30519MEDIUMXSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password fieEPSS 2.5%CVE-2023-0586MEDIUMAll in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 2.5%CVE-2022-38553MEDIUMAcademy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the SearEPSS 2.5%CVE-2021-3694HIGHCross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmbEPSS 2.5%CVE-2025-44136CRITICALMapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message withoutEPSS 2.5%CVE-2023-4451MEDIUMCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitEPSS 2.5%CVE-2021-24351—The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)EPSS 2.5%CVE-2021-43818HIGHHTML Cleaner allows crafted and SVG embedded scripts to pass throughEPSS 2.5%CVE-2023-52328MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52326MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52327MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2021-24383—WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.5%CVE-2023-2317HIGHTypora DOM-Based Cross-site Scripting leading to Remote Code ExecutionEPSS 2.4%CVE-2018-19787MEDIUMAn issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escEPSS 2.4%CVE-2023-52330MEDIUMA cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installEPSS 2.4%