Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24383—WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.5%CVE-2023-52327MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52328MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2023-52326MEDIUMCertain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atEPSS 2.5%CVE-2020-1055MEDIUMMicrosoft Active Directory Federation Services Cross-Site Scripting VulnerabilityEPSS 2.5%CVE-2023-2317HIGHTypora DOM-Based Cross-site Scripting leading to Remote Code ExecutionEPSS 2.4%CVE-2018-19787MEDIUMAn issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escEPSS 2.4%CVE-2021-34643MEDIUMSkaut bazar <= 1.3.2 Reflected Cross-Site ScriptingEPSS 2.4%CVE-2024-55890MEDIUMD-Tale allows Remote Code Execution through the Custom Filter InputEPSS 2.4%CVE-2022-0710MEDIUMHeader Footer Code Manager <= 1.1.16 Reflected XSSEPSS 2.4%CVE-2023-52330MEDIUMA cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installEPSS 2.4%CVE-2021-36738—XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletEPSS 2.4%CVE-2021-36737—XSS in V3 Demo PortletEPSS 2.4%CVE-2021-36739MEDIUMXSS vulnerability in the MVCBean JSP portlet maven archetypeEPSS 2.4%CVE-2022-28221MEDIUMCleanTalk AntiSpam <= 5.173 Reflected XSSEPSS 2.4%CVE-2016-8613MEDIUMA flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitEPSS 2.4%CVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2022-0928MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 2.4%CVE-2023-4382LOWtdevs Hyip Rio Profile Settings settings cross site scriptingEPSS 2.4%CVE-2023-6275LOWTOTVS Fluig Platform mobileredir openApp.jsp cross site scriptingEPSS 2.4%