Weaknesses of type CWE-79

29,311 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-53274LOWGHSL-2024-111: Reflected XSS in /home in habiticaEPSS 0.5%CVE-2024-10887MEDIUMNiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-20800MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-37675MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2022-45040MEDIUMA cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scEPSS 0.5%CVE-2024-2530LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php cross site scriptingEPSS 0.5%CVE-2020-27478HIGHCross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf1EPSS 0.5%CVE-2022-45613MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.5%CVE-2023-43712MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-46952MEDIUMCross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer headEPSS 0.5%CVE-2023-0323MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2024-53272MEDIUMGHSL-2024-109: Reflected XSS in /login in habiticaEPSS 0.5%CVE-2022-2777MEDIUMCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.5%CVE-2024-0557LOWDedeBIZ Website Copyright Setting cross site scriptingEPSS 0.5%CVE-2021-39427MEDIUMCross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.pEPSS 0.5%CVE-2023-20265MEDIUMA vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to EPSS 0.5%CVE-2024-48536HIGHIncorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a cEPSS 0.5%CVE-2024-55878MEDIUMCross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLExEPSS 0.5%CVE-2023-51843HIGHreact-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.EPSS 0.5%CVE-2024-37671MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%