Weaknesses of type CWE-79

29,035 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-4736LOWVenganzas del Pasado cross site scriptingEPSS 0.6%CVE-2022-4881MEDIUMCapsAdmin PAC3 http.lua cross site scriptingEPSS 0.6%CVE-2022-4235MEDIUMRushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible EPSS 0.6%CVE-2024-25327MEDIUMCross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code viEPSS 0.6%CVE-2023-40592HIGHReflected Cross-site Scripting (XSS) on "/app/search/table" web endpointEPSS 0.6%CVE-2023-4945MEDIUMBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-2146LOWSourceCodester Online Mobile Management Store ?p=products cross site scriptingEPSS 0.6%CVE-2023-52046MEDIUMCross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted paylEPSS 0.6%CVE-2021-37374MEDIUMCross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the FriendlEPSS 0.6%CVE-2022-36432MEDIUMThe Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-siteEPSS 0.6%CVE-2021-36889LOWWordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2020-20521MEDIUMCross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.EPSS 0.6%CVE-2021-41836MEDIUMFathom Analytics <= 3.0.4 Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-66395CRITICALSiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan ProtocolEPSS 0.6%CVE-2020-20070MEDIUMCross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameteEPSS 0.6%CVE-2022-37421MEDIUMSilverstripe silverstripe/cms through 4.11.0 allows XSS.EPSS 0.6%CVE-2023-3445LOWCross-site Scripting (XSS) - Stored in spinacms/spinaEPSS 0.6%CVE-2022-27848LOWWordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-34658MEDIUMWordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2026-68534LOWConcrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectorsEPSS 0.6%