Weaknesses of type CWE-79

29,053 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-42478HIGHCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2022-3415MEDIUMChat Bubble < 2.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-6033HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2023-1042LOWSourceCodester Online Pet Shop We App update_status.php cross site scriptingEPSS 0.6%CVE-2023-3381LOWSourceCodester Online School Fees System GET Parameter datatable.php cross site scriptingEPSS 0.6%CVE-2021-36871MEDIUMWordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilitiesEPSS 0.6%CVE-2023-2922LOWSourceCodester Comment System GET Parameter index.php cross site scriptingEPSS 0.6%CVE-2024-3068MEDIUMCustom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5026LOWTongda OA cross site scriptingEPSS 0.6%CVE-2024-0384MEDIUMWP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe NotesEPSS 0.6%CVE-2023-1354LOWSourceCodester Design and Implementation of Covid-19 Directory on Vaccination System register.php cross site scriptingEPSS 0.6%CVE-2022-4957LOWlibrespeed speedtest stats.php cross site scriptingEPSS 0.6%CVE-2023-0119MEDIUMForeman: stored cross-site scripting in host tabEPSS 0.6%CVE-2021-23209MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2022-36350MEDIUMStored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unsEPSS 0.6%CVE-2023-0810HIGHCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.6%CVE-2024-0504LOWcode-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scriptingEPSS 0.6%CVE-2024-22492MEDIUMA stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbiEPSS 0.6%CVE-2026-8391MEDIUMOther issue in the JavaScript Engine componentEPSS 0.6%CVE-2021-23150MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%