Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-7463MEDIUMJBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes aEPSS 1.8%CVE-2018-0328—A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remoEPSS 1.8%CVE-2021-21084HIGHAdobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code executionEPSS 1.8%CVE-2020-8204—A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.EPSS 1.8%CVE-2021-3831HIGHCross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5EPSS 1.8%CVE-2022-0533—Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)EPSS 1.8%CVE-2021-24545—WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site ScriptingEPSS 1.8%CVE-2022-1937—Awin Data Feed < 1.8 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2022-0970HIGHCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.8%CVE-2021-25016—Chaty < 2.8.3 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2023-41178MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.8%CVE-2023-41176MEDIUMReflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticEPSS 1.8%CVE-2023-3526CRITICALPHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devicesEPSS 1.8%CVE-2024-28734MEDIUMCross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted EPSS 1.8%CVE-2022-1170—JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site ScriptingEPSS 1.8%CVE-2018-0366—A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker EPSS 1.8%CVE-2018-0356—A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) EPSS 1.8%CVE-2018-0354—A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripEPSS 1.8%CVE-2018-0339—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.8%CVE-2018-0458—Cisco Prime Collaboration Assurance Cross-Site Scripting VulnerabilityEPSS 1.8%