Weaknesses of type CWE-79

30,465 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-5631MEDIUMStored XSS vulnerability in RoundcubeEPSS 76.3%KEVCVE-2023-5914MEDIUM  Cross-site scripting (XSS)EPSS 75.5%CVE-2024-31138MEDIUMIn JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsEPSS 74.7%CVE-2024-37383MEDIUMRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.EPSS 74.0%KEVCVE-2024-49754HIGHLibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phpEPSS 73.9%CVE-2019-9978MEDIUMThe social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameterEPSS 72.9%KEVCVE-2023-45138CRITICALChange Request Application vulnerable to XSS and remote code execution through change request titleEPSS 71.7%CVE-2022-36098HIGHXWiki Platform Mentions UI vulnerable to Cross-site ScriptingEPSS 71.6%CVE-2026-42897HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 70.7%KEVCVE-2022-47523CRITICALZoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL InjectionEPSS 70.6%CVE-2023-32071CRITICALXWiki Platform vulnerable to RXSS via editor parameter - importinline templateEPSS 70.4%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 70.1%CVE-2022-34258MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 69.9%CVE-2023-4347HIGHCross-site Scripting (XSS) - Reflected in librenms/librenmsEPSS 69.7%CVE-2022-0364—Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingEPSS 69.6%CVE-2022-48428MEDIUMIn JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possibleEPSS 68.0%CVE-2019-18426HIGHA vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-sEPSS 67.9%KEVCVE-2022-36801MEDIUMAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a RefEPSS 67.1%CVE-2020-8264—In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to sEPSS 67.0%CVE-2022-0832MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 66.6%