Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-1567MEDIUMWP JS <= 2.0.6 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2024-21389HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.2%CVE-2022-0429—WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.2%CVE-2023-29201CRITICALorg.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityEPSS 1.2%CVE-2023-3550HIGHStored XSS leads to privilege escalation in MediaWiki v1.40.0EPSS 1.2%CVE-2024-47605MEDIUMCross-site Scripting via insert media remote file oembed in silverstripe-asset-adminEPSS 1.1%CVE-2021-24124—WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)EPSS 1.1%CVE-2020-11083LOWStored XSS in OctoberEPSS 1.1%CVE-2024-11388MEDIUMDino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-7703MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 1.1%CVE-2020-25715—A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack tEPSS 1.1%CVE-2024-21395HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2021-39178HIGHXSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0EPSS 1.1%CVE-2020-8155—An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening aEPSS 1.1%CVE-2021-39349MEDIUMAuthor Bio Box <= 3.3.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-11428MEDIUMLazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-52951HIGHStored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to eEPSS 1.1%CVE-2024-47875CRITICALDOMPurify nesting-based mXSSEPSS 1.1%CVE-2024-21520MEDIUMVersions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fEPSS 1.1%CVE-2021-40714MEDIUMAdobe Experience Manager Reflected Cross Site Scripting via accesskey parameterEPSS 1.1%