Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-35162CRITICALXPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions templateEPSS 2.4%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2020-15169MEDIUMXSS in Action ViewEPSS 2.4%CVE-2023-33002MEDIUMJenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scriptEPSS 2.4%CVE-2021-24664—WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site ScriptingEPSS 2.4%CVE-2021-39322MEDIUMEasy Social Icons <= 3.0.8 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2022-21702MEDIUMCross site scripting in Grafana proxyEPSS 2.3%CVE-2022-0149—WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)EPSS 2.3%CVE-2017-12254—A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a DocumEPSS 2.3%CVE-2018-6333CRITICALThe hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a maliciEPSS 2.3%CVE-2022-0653MEDIUMProfile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site ScriptingEPSS 2.3%CVE-2021-39320MEDIUMunderConstruction <= 1.18 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2024-52803HIGHLLama Factory Remote OS Command Injection VulnerabilityEPSS 2.3%CVE-2020-10146MEDIUMMicrosoft Teams displayName stored cross-site scripting vulnerabilityEPSS 2.3%CVE-2021-24444—TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 2.3%CVE-2018-10609—Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket EPSS 2.3%CVE-2021-34640MEDIUMSecurimage-WP-Fixed <= 3.5.4 Reflected Cross-Site ScriptingEPSS 2.3%CVE-2022-0212—SpiderCalendar <= 1.5.65 - Reflected Cross-Site ScriptingEPSS 2.3%CVE-2021-25078—Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 2.3%CVE-2023-46732CRITICALReflected Cross-site scripting through revision parameter in content menu in XWiki PlatformEPSS 2.3%