Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-14862MEDIUMThere is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web applicationEPSS 2.1%CVE-2021-24176—JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 2.0%CVE-2020-15138HIGHCross-Site Scripting in PrismEPSS 2.0%CVE-2011-2920MEDIUMSpacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.EPSS 2.0%CVE-2018-0199—A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSEPSS 2.0%CVE-2022-0208—MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scriptingEPSS 2.0%CVE-2017-2601MEDIUMJenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). UEPSS 2.0%CVE-2023-45134CRITICALXWiki Platform XSS vulnerability from account in the create page form via template providerEPSS 2.0%CVE-2007-4039CRITICALArgument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripEPSS 2.0%CVE-2021-25055—FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)EPSS 2.0%CVE-2019-0558MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 2.0%CVE-2023-29247—Stored XSS on Apache AirflowEPSS 2.0%CVE-2023-36892HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 2.0%CVE-2023-36891HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 2.0%CVE-2021-24364—Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)EPSS 2.0%CVE-2021-24342—JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)EPSS 2.0%CVE-2018-0357—A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) EPSS 2.0%CVE-2023-22373MEDIUMCross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an aEPSS 2.0%CVE-2022-1231CRITICALXSS via Embedded SVG in SVG Diagram Format in plantuml/plantumlEPSS 2.0%CVE-2022-1916—Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-ScriptingEPSS 1.9%