Weaknesses of type CWE-79

30,668 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-26842MEDIUMA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the EPSS 1.4%CVE-2021-24934—Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2022-0385—Crazy Bone <= 0.6.0 - Unauthenticated Stored XSSEPSS 1.4%CVE-2024-47374HIGHWordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.4%CVE-2024-26251MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.4%CVE-2023-35393MEDIUMAzure Apache Hive Spoofing VulnerabilityEPSS 1.4%CVE-2023-29202CRITICALorg.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityEPSS 1.4%CVE-2023-29207HIGHImproper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable MacroEPSS 1.4%CVE-2016-10547—Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in auEPSS 1.4%CVE-2020-10688—A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haEPSS 1.4%CVE-2022-42711CRITICALIn Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could alEPSS 1.4%CVE-2026-26144HIGHMicrosoft Excel Information Disclosure VulnerabilityEPSS 1.4%CVE-2021-24241—Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)EPSS 1.4%CVE-2022-2168—Download Manager < 3.2.44 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2022-42746MEDIUMCandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This EPSS 1.4%CVE-2021-3486—GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.EPSS 1.4%CVE-2023-45671MEDIUMFrigate reflected XSS through `/<camera_name>` API endpointsEPSS 1.4%CVE-2025-22466HIGHReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaEPSS 1.4%CVE-2024-53442CRITICALwhapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.EPSS 1.4%CVE-2021-1245MEDIUMCisco Finesse OpenSocial Gadget Editor Cross-Site Scripting VulnerabilityEPSS 1.4%