Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-9740CRITICALStored XSS in AEM Design Importer ComponentEPSS 1.9%CVE-2020-9734CRITICALStored XSS in AEM Forms componentEPSS 1.9%CVE-2023-29347HIGHWindows Admin Center Spoofing VulnerabilityEPSS 1.9%CVE-2022-0963MEDIUMUnrestricted XML Files Leads to Stored XSS in microweber/microweberEPSS 1.9%CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2022-1007—Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2020-8262—A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) anEPSS 1.8%CVE-2022-1168—JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 1.8%CVE-2021-25016—Chaty < 2.8.3 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2020-9742CRITICALReflected XSS in AEM Inbox moduleEPSS 1.8%CVE-2021-3831HIGHCross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5EPSS 1.8%CVE-2023-27898CRITICALJenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depeEPSS 1.8%CVE-2018-0251—A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive SEPSS 1.8%CVE-2022-1937—Awin Data Feed < 1.8 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2021-4285LOWNagios NCPA tail.html cross site scriptingEPSS 1.8%CVE-2024-43481MEDIUMPower BI Report Server Spoofing VulnerabilityEPSS 1.8%CVE-2022-48178MEDIUMX2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action fuEPSS 1.8%CVE-2022-48177MEDIUMX2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importMoEPSS 1.8%CVE-2021-24436—W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)EPSS 1.8%CVE-2020-0924MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.8%