Weaknesses of type CWE-79

29,274 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-36573MEDIUMFile Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.EPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2024-13736MEDIUMPure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName ParameterEPSS 0.5%CVE-2024-57277MEDIUMInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.EPSS 0.5%CVE-2024-1236MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-44071MEDIUMZenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.EPSS 0.5%CVE-2024-22569MEDIUMStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /indexEPSS 0.5%CVE-2024-0435HIGHUser can submit message to self-XSSEPSS 0.5%CVE-2024-4891MEDIUMEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-51303MEDIUMPHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_coEPSS 0.5%CVE-2024-11229MEDIUM코드엠샵 소셜톡 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk ShortcodesEPSS 0.5%CVE-2023-0337MEDIUMCross-site Scripting (XSS) - Reflected in lirantal/daloradiusEPSS 0.5%CVE-2022-45890MEDIUMIn Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., searchEPSS 0.5%CVE-2024-4360MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tagEPSS 0.5%CVE-2024-2518LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System book_history.php cross site scriptingEPSS 0.5%CVE-2023-49985MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execEPSS 0.5%CVE-2023-31434MEDIUMThe parameters nutzer_titel, nutzer_vn, and nutzer_nn in the user profile, and langID and ONLINEID in direct links, in evasys before 8.2 BuiEPSS 0.5%CVE-2024-51181HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0,EPSS 0.5%CVE-2023-0338MEDIUMCross-site Scripting (XSS) - Reflected in lirantal/daloradiusEPSS 0.5%CVE-2024-51180HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which aEPSS 0.5%