Weaknesses of type CWE-79

29,498 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-29016MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesEPSS 0.4%CVE-2024-25436MEDIUMA cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTMEPSS 0.4%CVE-2023-34172MEDIUMWordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-43381MEDIUMreNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record PoisoningEPSS 0.4%CVE-2023-24401MEDIUMWordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12500MEDIUMPhilantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-34418MEDIUMWordPress WPCS ( WordPress Custom Search ) plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-42197HIGHRELATE Vulnerable to Stored XSS via Unprivileged User ProfileEPSS 0.4%CVE-2024-21729MEDIUM[20240701] - Core - XSS in accessible media selection fieldEPSS 0.4%CVE-2024-35170MEDIUMWordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-34419MEDIUMWordPress Configure Login Timeout plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-1025MEDIUMSimple File List < 6.0.10 - Admin+ Stored XSSEPSS 0.4%CVE-2024-13506MEDIUMGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name ParameterEPSS 0.4%CVE-2022-41266HIGHDue to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows maliciouEPSS 0.4%CVE-2023-32294MEDIUMWordPress GDPR Cookie Consent Notice Box Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2023-36389HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEEPSS 0.4%CVE-2024-36210MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2023-0844—Namaste! LMS < 2.6 - Admin+ Stored XSSEPSS 0.4%CVE-2024-34417MEDIUMWordPress Viet Nam Affiliate plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%