Weaknesses of type CWE-79

29,487 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-45592HIGHauditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escapedEPSS 0.4%CVE-2023-42479MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Biller DirectEPSS 0.4%CVE-2026-62914HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.4%CVE-2021-47697MEDIUMNagios XI < 5.8.0 XSS via Views URL HandlingEPSS 0.4%CVE-2021-47691MEDIUMNagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services PageEPSS 0.4%CVE-2024-1276MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-34243MEDIUMKonga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.EPSS 0.4%CVE-2024-0678MEDIUMOrder Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2021-47696MEDIUMNagios XI < 5.8.0 XSS via BPI Config ID HandlingEPSS 0.4%CVE-2023-44040MEDIUMIn VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited byEPSS 0.4%CVE-2023-5164MEDIUMBellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-20205—Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPSS 0.4%CVE-2026-48848HIGHRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSSEPSS 0.4%CVE-2024-22551MEDIUMWhatACart v2.0.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /site/default/search.EPSS 0.4%CVE-2024-2623MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11688MEDIUMLaTeX2HTML <= 2.5.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4386MEDIUMGallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-35225CRITICALJupyter Server Proxy has a reflected XSS issue in host parameterEPSS 0.4%CVE-2024-23659MEDIUMSPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascriptEPSS 0.4%CVE-2023-27499MEDIUMCross-Site Scripting (XSS) vulnerability in SAP GUI for HTMLEPSS 0.4%