Weaknesses of type CWE-79

28,553 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24522—ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widgetEPSS 1.6%CVE-2020-0795MEDIUMThis vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.EPSS 1.5%CVE-2021-43764HIGHAdobe Experience Manager Stored XSS in the Spin SetEPSS 1.5%CVE-2022-46888MEDIUMMultiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web scriEPSS 1.5%CVE-2023-48082CRITICALNagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generatEPSS 1.5%CVE-2023-27905CRITICALJenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultinEPSS 1.5%CVE-2022-0262MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2022-36033MEDIUMjsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledEPSS 1.5%CVE-2022-1173HIGHstored xss in getgrav/gravEPSS 1.5%CVE-2021-32641HIGHReflected XSS when using flashMessagesEPSS 1.5%CVE-2020-11025MEDIUMAuthenticated cross-site scripting (XSS) in WordPress CustomizerEPSS 1.5%CVE-2023-0676LOWCross-site Scripting (XSS) - Reflected in phpipam/phpipamEPSS 1.5%CVE-2021-24834—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options ModuleEPSS 1.5%CVE-2019-10215MEDIUMBootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could explEPSS 1.5%CVE-2022-0230—Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.5%CVE-2022-43982MEDIUMApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLEPSS 1.5%CVE-2022-25630MEDIUMAn authenticated user can embed malicious content with XSS into the admin group policy page.EPSS 1.5%CVE-2018-7512—A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1EPSS 1.5%CVE-2020-1320MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.5%CVE-2020-1298MEDIUMA cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesEPSS 1.5%