Weaknesses of type CWE-79

28,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24756—WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2021-25086—Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2022-0571MEDIUMCross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suiteEPSS 1.3%CVE-2023-6134MEDIUMKeycloak: reflected xss via wildcard in oidc redirect_uriEPSS 1.3%CVE-2021-37695HIGHExecution of JavaScript code using malformed HTML in ckeditorEPSS 1.3%CVE-2021-33851—A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicEPSS 1.3%CVE-2021-43787CRITICALXSS via prototype pollutionEPSS 1.3%CVE-2024-28623MEDIUMRiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.EPSS 1.3%CVE-2023-37988HIGHWordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 1.3%CVE-2020-15139HIGHXSS in MyBBEPSS 1.3%CVE-2024-21328HIGHDynamics 365 Sales Spoofing VulnerabilityEPSS 1.3%CVE-2021-24973—Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.3%CVE-2023-29183HIGHAn improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7EPSS 1.3%CVE-2024-31868MEDIUMApache Zeppelin: XSS vulnerability in the helium moduleEPSS 1.3%CVE-2024-20719CRITICAL[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297EPSS 1.3%CVE-2024-27743MEDIUMCross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloaEPSS 1.3%CVE-2022-1187MEDIUMWP YouTube Live <= 1.7.21 - Reflected Cross-Site ScriptingEPSS 1.3%CVE-2026-55549MEDIUMYamcs: Reflected XSS in the URL of the Authorize EndpointEPSS 1.3%CVE-2021-24350—Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 1.3%CVE-2020-26249HIGHRemote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) VulnerabilityEPSS 1.3%