Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-1670MEDIUMCisco Unified Intelligence Center Software Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2019-1661MEDIUMCisco TelePresence Management Suite Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15467MEDIUMCisco TelePresence Management Suite Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15457MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2019-1702MEDIUMCisco Enterprise Chat and Email Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2019-1685MEDIUMCisco Unity Connection Reflected Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2019-1792MEDIUMCisco Umbrella Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15435MEDIUMCisco SocialMiner Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2019-1643MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15463MEDIUMCisco Identity Services Engine Multiple Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2019-1671MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2018-15461MEDIUMCisco Webex Business Suite Cross-Site Scripting VulnerabilityEPSS 1.2%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.2%CVE-2018-0401—Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenEPSS 1.2%CVE-2024-38108CRITICALAzure Stack Hub Spoofing VulnerabilityEPSS 1.2%CVE-2024-2997LOWBdtask Multi-Store Inventory Management System cross site scriptingEPSS 1.2%CVE-2022-24728MEDIUMCross-site Scripting in CKEditor4EPSS 1.2%CVE-2024-40482CRITICALAn Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows EPSS 1.2%CVE-2022-1091—Safe SVG < 1.9.10 - SVG Sanitisation BypassEPSS 1.2%CVE-2023-31664MEDIUMA reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers tEPSS 1.2%