Weaknesses of type CWE-79

29,105 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-4296LOWw3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scriptingEPSS 0.5%CVE-2024-57601MEDIUMCross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the leEPSS 0.5%CVE-2024-54795MEDIUMSpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer functiEPSS 0.5%CVE-2023-2584MEDIUMPixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-48013MEDIUMOpencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar.EPSS 0.5%CVE-2021-36398MEDIUMIn moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.EPSS 0.5%CVE-2018-25119MEDIUMNagios Fusion < 4.1.5 XSS via fusionwindow ParameterEPSS 0.5%CVE-2024-40626HIGHStored Cross-site Scripting (XSS) vulnerability in Outline editorEPSS 0.5%CVE-2022-3420MEDIUMOfficial Integration for Billingo < 3.4.0 - ShopManager+ Stored XSSEPSS 0.5%CVE-2024-53999HIGHMobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" FunctionalityEPSS 0.5%CVE-2024-1922LOWSourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scriptingEPSS 0.5%CVE-2024-5385MEDIUMoretnom23 Online Car Wash Booking System cross site scriptingEPSS 0.5%CVE-2024-2124MEDIUMTranslate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.5%CVE-2023-5362MEDIUMCarousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-44012MEDIUMAn issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. EPSS 0.5%CVE-2022-40840MEDIUMndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.EPSS 0.5%CVE-2024-3125LOWZebra ZTC GK420d Alert Setup Page settings cross site scriptingEPSS 0.5%CVE-2024-8411MEDIUMABCD ABCD2 buscar_integrada.php cross site scriptingEPSS 0.5%CVE-2024-7225MEDIUMSourceCodester Insurance Management System Edit Insurance Policy Page update_policy cross site scriptingEPSS 0.5%CVE-2026-28315MEDIUMSolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) VulnerabilityEPSS 0.5%