Weaknesses of type CWE-79

30,432 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2018-0354—A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripEPSS 1.7%CVE-2018-0356—A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) EPSS 1.7%CVE-2020-15183HIGHReflected XSS leading to RCE in SoyCMSEPSS 1.7%CVE-2018-0339—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2023-29439HIGHWordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)EPSS 1.7%CVE-2020-15275HIGHmalicious SVG attachment causing stored XSS vulnerability in MoinMoinEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2020-8238—A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to cEPSS 1.7%CVE-2021-38346HIGHBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path TraversalEPSS 1.7%CVE-2017-14850MEDIUMAll known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to imEPSS 1.7%CVE-2022-43015MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.EPSS 1.7%CVE-2024-41937MEDIUMApache Airflow: Stored XSS Vulnerability on provider linkEPSS 1.7%CVE-2020-7006—Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerabilitEPSS 1.7%CVE-2018-0118—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2018-0242—A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attEPSS 1.7%CVE-2020-1101MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1099MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2020-1100MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 1.7%CVE-2021-24409—Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2023-29506MEDIUMorg.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsEPSS 1.7%