Weaknesses of type CWE-79

29,586 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8788MEDIUMEU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-44956MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulneEPSS 0.4%CVE-2022-44959MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulneEPSS 0.4%CVE-2022-45848MEDIUMWordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-20140MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-20138MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2024-34428MEDIUMWordPress AWSOM News Announcement plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8566MEDIUMcode-projects Online Shop Store settings.php cross site scriptingEPSS 0.4%CVE-2023-20141MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-34004MEDIUMWordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-20148MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2011-10006LOWGamerZ WP-PostRatings wp-postratings.php cross site scriptingEPSS 0.4%CVE-2023-6838MEDIUMReflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authEPSS 0.4%CVE-2024-9378MEDIUMYML for Yandex Market <= 4.7.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-20146MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2024-12995MEDIUMruifang-tech Rebuild Project Tasks Section tasks cross site scriptingEPSS 0.4%CVE-2023-5758MEDIUMWhen opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site ScripEPSS 0.4%CVE-2023-2604MEDIUMTeam Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-23345HIGHNautobot has XSS potential in rendered Markdown fieldsEPSS 0.4%