Weaknesses of type CWE-79

29,368 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-54042MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2022-23499MEDIUMCross-Site Scripting Protection bypass in HTML SanitizerEPSS 0.5%CVE-2024-11427MEDIUMCatch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-8215HIGHPayload Injection Attack via Management REST interfaceEPSS 0.5%CVE-2024-12262MEDIUMEbook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'EPSS 0.5%CVE-2024-40742MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.5%CVE-2023-38364MEDIUMIBM CICS TX Advanced cross-site scriptingEPSS 0.5%CVE-2024-26473MEDIUMA reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the wEPSS 0.5%CVE-2024-5260MEDIUMSina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text ParameterEPSS 0.5%CVE-2022-22804—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authEPSS 0.5%CVE-2024-2868MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product LayoutEPSS 0.5%CVE-2024-0722LOWcode-projects Social Networking Site Message Page message.php cross site scriptingEPSS 0.5%CVE-2021-36712MEDIUMCross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.EPSS 0.5%CVE-2021-34590MEDIUMBender Charge Controller: Cross-site ScriptingEPSS 0.5%CVE-2024-48656MEDIUMCross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrarEPSS 0.5%CVE-2023-40674MEDIUMWordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-5784HIGHStored XSS in DivvyDrive Information Technologies' DivvyDriveEPSS 0.4%CVE-2024-2515LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System home.php cross site scriptingEPSS 0.4%CVE-2024-42771MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System vEPSS 0.4%CVE-2023-49977MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.4%