Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-4051LOWXSS in Dijit Editor's LinkDialog pluginEPSS 1.2%CVE-2022-30999HIGHPossible cross-site scripting attack via unsanitized SVG files in FoF UploadEPSS 1.2%CVE-2023-23491MEDIUMThe Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' pEPSS 1.2%CVE-2023-26776MEDIUMCross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of tEPSS 1.2%CVE-2023-33130HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.2%CVE-2017-2661—ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field wEPSS 1.2%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2022-42746MEDIUMCandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This EPSS 1.2%CVE-2021-24234—Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)EPSS 1.2%CVE-2023-30210MEDIUMOURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.EPSS 1.2%CVE-2019-5422—XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitEPSS 1.2%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2021-0275HIGHJunos OS: J-Web: Cross-site scripting attack allows an attacker to gain control of another users session.EPSS 1.2%CVE-2026-49069HIGHWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.2%CVE-2017-6611—A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a EPSS 1.2%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2021-42363MEDIUMPreview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site ScriptingEPSS 1.2%CVE-2021-24797—Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%CVE-2021-24792—Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%CVE-2021-24967—Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%