Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-22373MEDIUMCross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an aEPSS 1.9%CVE-2018-0251—A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive SEPSS 1.9%CVE-2022-1007—Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2021-24979—Paid Memberships Pro < 2.6.6 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2020-4054HIGHCross-site Scripting in SanitizeEPSS 1.9%CVE-2025-34141MEDIUMETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`EPSS 1.9%CVE-2022-1724—Simple Membership < 4.1.1 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2020-8262—A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) anEPSS 1.8%CVE-2022-1168—JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 1.8%CVE-2020-9742CRITICALReflected XSS in AEM Inbox moduleEPSS 1.8%CVE-2023-27898CRITICALJenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depeEPSS 1.8%CVE-2023-45134CRITICALXWiki Platform XSS vulnerability from account in the create page form via template providerEPSS 1.8%CVE-2022-48178MEDIUMX2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action fuEPSS 1.8%CVE-2022-48177MEDIUMX2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importMoEPSS 1.8%CVE-2024-43481MEDIUMPower BI Report Server Spoofing VulnerabilityEPSS 1.8%CVE-2020-0924MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.8%CVE-2024-4348MEDIUMosCommerce all-products cross site scriptingEPSS 1.8%CVE-2022-40359MEDIUMCross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.EPSS 1.8%CVE-2018-0386—A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-sEPSS 1.8%CVE-2023-26750CRITICALSQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code viEPSS 1.8%