Weaknesses of type CWE-79

29,251 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-51122MEDIUMCross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arbEPSS 0.5%CVE-2023-2361MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2024-8112MEDIUMthinkgem JeeSite Cookie login cross site scriptingEPSS 0.5%CVE-2024-8867MEDIUMPerfex CRM Parameter Clients.php cross site scriptingEPSS 0.5%CVE-2023-1147MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2022-28612MEDIUMWordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSSEPSS 0.5%CVE-2023-2340MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-1146MEDIUMCross-site Scripting (XSS) - Generic in flatpressblog/flatpressEPSS 0.5%CVE-2023-5109MEDIUMWP Mailto Links – Protect Email Addresses <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-7945MEDIUMitsourcecode Laravel Property Management System Notes Page create cross site scriptingEPSS 0.5%CVE-2024-9299MEDIUMSourceCodester Online Railway Reservation System ?page=reserve cross site scriptingEPSS 0.5%CVE-2024-2391LOWEVE-NG Lab cross site scriptingEPSS 0.5%CVE-2024-36181MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-12468MEDIUMWP Datepicker <= 2.1.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1774HIGHCustomily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2730MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-0995MEDIUMCross-site Scripting (XSS) - Stored in unilogies/bumsysEPSS 0.5%CVE-2026-65644HIGHRocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/liveEPSS 0.5%CVE-2022-42236MEDIUMA Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.EPSS 0.5%CVE-2022-43046MEDIUMFood Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-orderEPSS 0.5%