Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-15275HIGHmalicious SVG attachment causing stored XSS vulnerability in MoinMoinEPSS 1.7%CVE-2017-14850MEDIUMAll known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to imEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2022-46381MEDIUMCertain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component).EPSS 1.7%CVE-2020-8238—A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to cEPSS 1.7%CVE-2021-38346HIGHBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path TraversalEPSS 1.7%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2024-41937MEDIUMApache Airflow: Stored XSS Vulnerability on provider linkEPSS 1.7%CVE-2020-7006—Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerabilitEPSS 1.7%CVE-2018-0118—A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2021-24409—Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2023-29506MEDIUMorg.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsEPSS 1.7%CVE-2025-25062MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text contentEPSS 1.7%CVE-2022-0150—WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)EPSS 1.7%CVE-2022-0248—Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSSEPSS 1.7%CVE-2022-24891MEDIUMCross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration fileEPSS 1.7%CVE-2018-0223—A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attEPSS 1.7%CVE-2018-0212—A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeEPSS 1.7%CVE-2018-0219—A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remotEPSS 1.7%CVE-2017-12248—A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to cEPSS 1.7%