Weaknesses of type CWE-79

28,567 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-45671MEDIUMFrigate reflected XSS through `/<camera_name>` API endpointsEPSS 1.4%CVE-2022-0899—Header Footer Code Manager < 1.1.24 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-26947MEDIUMCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbEPSS 1.4%CVE-2022-1910—Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-ScriptingEPSS 1.4%CVE-2024-47951LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settingsEPSS 1.4%CVE-2024-47950LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settingsEPSS 1.4%CVE-2024-47374HIGHWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.4%CVE-2021-44178MEDIUMAdobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.htmlEPSS 1.4%CVE-2018-1081—A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users cEPSS 1.4%CVE-2021-36027MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.4%CVE-2022-26101—Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulneEPSS 1.4%CVE-2022-24399—The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingEPSS 1.4%CVE-2023-27335HIGHSofting edgeAggregator Client Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.4%CVE-2021-32702HIGHReflected XSS from the callback handler's error query parameterEPSS 1.4%CVE-2017-2683—A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitEPSS 1.4%CVE-2020-8189—A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invaEPSS 1.4%CVE-2021-3994HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 1.4%CVE-2022-28290—Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the userEPSS 1.4%CVE-2021-24934—Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%