Weaknesses of type CWE-79

29,486 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-45889MEDIUMA Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScrEPSS 0.4%CVE-2024-2423MEDIUMUsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-33937MEDIUMStored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 befoEPSS 0.4%CVE-2016-15052MEDIUMNagios XI < 5.2.4 XSS via Menu SystemEPSS 0.4%CVE-2023-20204MEDIUMA vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remotEPSS 0.4%CVE-2024-3595MEDIUMPure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2016-15053MEDIUMNagios XI < 5.2.4 XSS via “My Reports” ListingEPSS 0.4%CVE-2023-33943MEDIUMCross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 thEPSS 0.4%CVE-2024-4630MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-45816MEDIUMWordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6561MEDIUMFeatured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt textEPSS 0.4%CVE-2023-5639MEDIUMTeam Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-4315MEDIUMWoo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_editEPSS 0.4%CVE-2021-47695MEDIUMNagios XI < 5.8.0 XSS via My Tools PageEPSS 0.4%CVE-2026-69402HIGHMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2025-2944MEDIUMJeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown WidgetsEPSS 0.4%CVE-2023-6571MEDIUMCross-site Scripting (XSS) - Reflected in kubeflow/kubeflowEPSS 0.4%CVE-2023-20203—Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPSS 0.4%CVE-2023-42479MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Biller DirectEPSS 0.4%CVE-2024-45592HIGHauditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escapedEPSS 0.4%