Weaknesses of type CWE-79

29,053 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-23150MEDIUMWordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-27054MEDIUMA cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML vEPSS 0.6%CVE-2024-0504LOWcode-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scriptingEPSS 0.6%CVE-2024-51430MEDIUMCross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary EPSS 0.6%CVE-2023-0810HIGHCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.6%CVE-2024-2940LOWCampcodes Online Examination System updateCourse.php cross site scriptingEPSS 0.6%CVE-2020-26799CRITICALA reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker toEPSS 0.6%CVE-2024-7321MEDIUMitsourcecode Online Blood Bank Management System User Registration signup.php cross site scriptingEPSS 0.6%CVE-2022-38460MEDIUMWordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-26269CRITICALCross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.EPSS 0.6%CVE-2024-2255MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2629—Top Bar < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-4882LOWkaltura mwEmbed Share Plugin share.js cross site scriptingEPSS 0.6%CVE-2023-32766MEDIUMGitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiEPSS 0.6%CVE-2024-25147CRITICALCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andEPSS 0.6%CVE-2024-5727MEDIUMWidget4Call <= 1.0.7 - Reflected XSSEPSS 0.6%CVE-2022-4694MEDIUMCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-34650MEDIUMWordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2026-50883CRITICALAn HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts viEPSS 0.6%CVE-2023-39521MEDIUMTuleap vulnerable to Cross-site Scripting on the success message of a kanban deletionEPSS 0.6%