Weaknesses of type CWE-79

30,666 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24979—Paid Memberships Pro < 2.6.6 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2022-1290CRITICALStored XSS in "Name", "Group Name" & "Title" in polonel/trudeskEPSS 1.7%CVE-2024-24816MEDIUMCross-site scripting (XSS) vulnerability in samples with enabled the preview featureEPSS 1.7%CVE-2021-25085—WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2023-6568MEDIUMReflected XSS via Content-Type Header in mlflow/mlflowEPSS 1.6%CVE-2020-0903MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request EPSS 1.6%CVE-2021-44177HIGHAdobe Experience Manager Stored XSS in user name parameter in the package managerEPSS 1.6%CVE-2021-43765HIGHAdobe Experience Manager Stored XSS in the Carousel SetEPSS 1.6%CVE-2021-44176HIGHAdobe Experience Manager Stored XSS in workflow Stages parameterEPSS 1.6%CVE-2017-6654—A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticatEPSS 1.6%CVE-2022-0250—Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2023-1880HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 1.6%CVE-2022-36033MEDIUMjsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledEPSS 1.6%CVE-2021-36026MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.6%CVE-2019-0556MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2016-9472—Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected EPSS 1.6%CVE-2018-3830—Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker toEPSS 1.6%CVE-2019-15071—Openfind MAIL2000 Webmail Pre-Auth Cross-Site ScriptingEPSS 1.6%CVE-2022-3506MEDIUMCross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wpEPSS 1.6%CVE-2021-24214—OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login ErrorEPSS 1.6%