Weaknesses of type CWE-79

28,989 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24471—YouTube Embed < 5.2.2 - Contributor+ Stored XSSEPSS 0.6%CVE-2022-33943MEDIUMWordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2026-57977HIGHMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2023-1106MEDIUMCross-site Scripting (XSS) - Reflected in flatpressblog/flatpressEPSS 0.6%CVE-2023-2630MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2021-24531—Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-33853—A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a truEPSS 0.6%CVE-2023-4534LOWNeoMind Fusion Platform Link cross site scriptingEPSS 0.6%CVE-2023-3469MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.6%CVE-2023-1783MEDIUMOrangeScrum 2.0.11 - AWS Credentials Leak via PDF RenderingEPSS 0.6%CVE-2023-2421LOWControl iD RHiD department cross site scriptingEPSS 0.6%CVE-2024-30987MEDIUMCross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers EPSS 0.6%CVE-2023-2397LOWSourceCodester Simple Mobile Comparison Website cross site scriptingEPSS 0.6%CVE-2024-21496MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to iEPSS 0.6%CVE-2024-30988MEDIUMCross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to EPSS 0.6%CVE-2022-4410MEDIUMPermalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-4097HIGHCost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG UploadEPSS 0.6%CVE-2024-23186MEDIUME-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. AttackerEPSS 0.6%CVE-2024-1010LOWSourceCodester Employee Management System edit-profile.php cross site scriptingEPSS 0.6%CVE-2023-28850MEDIUMPimcore Perspective Editor vulnerable to Cross-site Scripting in perspective nameEPSS 0.6%