Weaknesses of type CWE-79

30,666 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-3509—A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStoEPSS 1.7%CVE-2022-43670MEDIUMXSS in Sling CMS Reference App Taxonomy PathEPSS 1.7%CVE-2019-16780MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.7%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2019-18267—An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbEPSS 1.7%CVE-2024-57686CRITICALA Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which alloEPSS 1.7%CVE-2022-2219—Unyson < 2.7.27 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2021-24319—Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSEPSS 1.7%CVE-2020-9737MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2020-9738MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2014-5408—Nordex NC2 Cross-site ScriptingEPSS 1.7%CVE-2022-27777—A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control inputEPSS 1.7%CVE-2019-1010237—Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impacEPSS 1.7%CVE-2024-41662HIGHVNote vulnerable to Markdown XSS, which leads to RCEEPSS 1.7%CVE-2021-37700MEDIUMClipboard-based DOM-XSSEPSS 1.7%CVE-2016-6343MEDIUMJBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to EPSS 1.7%CVE-2016-9466—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery apEPSS 1.7%CVE-2021-24875—eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2021-32609—XSS vulnerability on Explore pageEPSS 1.7%