Weaknesses of type CWE-79

29,345 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-43727MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2022-29610—SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could resultEPSS 0.5%CVE-2023-43710MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-10419MEDIUMcode-projects Blood Bank Management System bloodrequest.php cross site scriptingEPSS 0.5%CVE-2023-43708MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43721MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43719MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-9810MEDIUMSourceCodester Record Management System sort2_user.php cross site scriptingEPSS 0.5%CVE-2023-38582MEDIUMSocomec MOD3GP-SY-120K Cross-site ScriptingEPSS 0.5%CVE-2024-31972MEDIUMEnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execuEPSS 0.5%CVE-2023-43716MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-9356MEDIUMYotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-43725MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43722MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-10701MEDIUMPHPGurukul Car Rental Portal search.php cross site scriptingEPSS 0.5%CVE-2022-45050MEDIUMReflected XSS in Axiell Iguana CMSEPSS 0.5%CVE-2024-4968MEDIUMSourceCodester Interactive Map with Marker Add Marker Marker Name cross site scriptingEPSS 0.5%CVE-2023-43705MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43703MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-6955MEDIUMSourceCodester Record Management System sort2.php cross site scriptingEPSS 0.5%