Weaknesses of type CWE-79

28,552 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-41165HIGHHTML comments vulnerability allowing to execute JavaScript codeEPSS 1.6%CVE-2022-0148—All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.6%CVE-2024-32077MEDIUMApache Airflow: XSS vulnerability in Task Instance Log/Log DetailsEPSS 1.6%CVE-2019-0831MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-0830MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-1134MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2020-26298MEDIUMInjection in RedcarpetEPSS 1.6%CVE-2021-21422HIGHXSS Vulnerability in mongo-expressEPSS 1.6%CVE-2020-12021—In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attEPSS 1.6%CVE-2021-24910—Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2020-1454MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.6%CVE-2023-22462MEDIUMStored XSS in Grafana Text pluginEPSS 1.6%CVE-2019-15587—In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.EPSS 1.6%CVE-2021-4084HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.6%CVE-2022-0147—Cookie Information < 2.0.8 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2019-0047HIGHJunos OS: Persistent XSS vulnerability in J-WebEPSS 1.6%CVE-2020-1760MEDIUMA flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potenEPSS 1.6%CVE-2020-1673HIGHJunos OS: Reflected Cross-site Scripting vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 1.6%CVE-2020-0694MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.6%CVE-2019-18267—An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbEPSS 1.6%