Weaknesses of type CWE-79

30,668 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24807—Support Board < 3.3.5 - Agent+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2022-0268MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2022-2170—Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2016-10531—marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificallEPSS 1.4%CVE-2018-1081—A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users cEPSS 1.4%CVE-2024-47951LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settingsEPSS 1.4%CVE-2022-48012MEDIUMOpencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settiEPSS 1.4%CVE-2024-47950LOWIn JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settingsEPSS 1.4%CVE-2022-34870MEDIUMApache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationEPSS 1.4%CVE-2018-3769—ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.EPSS 1.4%CVE-2022-26101—Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulneEPSS 1.4%CVE-2022-24399—The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingEPSS 1.4%CVE-2023-27335HIGHSofting edgeAggregator Client Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.4%CVE-2017-2683—A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitEPSS 1.4%CVE-2020-8189—A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invaEPSS 1.4%CVE-2021-26947MEDIUMCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbEPSS 1.4%CVE-2022-28290—Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the userEPSS 1.4%CVE-2021-3994HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 1.4%CVE-2021-32702HIGHReflected XSS from the callback handler's error query parameterEPSS 1.4%CVE-2021-28556MEDIUMMagento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionEPSS 1.4%