Weaknesses of type CWE-79

28,444 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-48343MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.EPSS 59.5%CVE-2023-43770MEDIUMRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of EPSS 58.5%KEVCVE-2023-22249MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 58.5%CVE-2022-32174CRITICALGogs - XSSEPSS 58.0%CVE-2022-36097HIGHXWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formEPSS 57.4%CVE-2023-27293MEDIUMImproper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer EPSS 57.0%CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 56.4%CVE-2022-1104—Popup Maker < 1.16.5 - Admin+ Stored Cross-Site ScriptingEPSS 56.4%CVE-2023-0028MEDIUMCross-site Scripting (XSS) - Stored in linagora/twakeEPSS 56.0%CVE-2023-41249MEDIUMIn JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build StepEPSS 55.5%CVE-2023-40000HIGHWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerabilityEPSS 54.9%CVE-2025-44148CRITICALCross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx coEPSS 54.7%CVE-2023-41425MEDIUMCross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scripEPSS 54.3%CVE-2023-50231HIGHNETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation VulnerabilityEPSS 53.3%CVE-2022-1178HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.6%CVE-2022-1181HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.5%CVE-2024-1451HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 51.5%CVE-2013-5223MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitraEPSS 50.8%KEVCVE-2022-45365HIGHWordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)EPSS 48.9%CVE-2024-21726MEDIUM[20240205] - Core - Inadequate content filtering within the filter codeEPSS 48.8%