Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24310—Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery TitleEPSS 1.1%CVE-2024-28160HIGHJenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingEPSS 1.1%CVE-2021-32478—The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versioEPSS 1.1%CVE-2019-18578CRITICALDell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of EPSS 1.1%CVE-2007-5954MEDIUMCross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary web script or HTML viEPSS 1.1%CVE-2021-21079MEDIUMAdobe Connect Reflected Cross-site Scripting via archiveOffset parameterEPSS 1.1%CVE-2021-24833—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview ModuleEPSS 1.1%CVE-2020-12517HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).EPSS 1.1%CVE-2022-42749MEDIUMCandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poEPSS 1.1%CVE-2022-42748MEDIUMCandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TEPSS 1.1%CVE-2022-42747MEDIUMCandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is EPSS 1.1%CVE-2021-29459CRITICALXSS Cross Site ScriptingEPSS 1.1%CVE-2021-25022MEDIUMUpdraftPlus < 1.16.66 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2022-45064HIGHApache Sling Engine: Include-based XSSEPSS 1.1%CVE-2022-1961MEDIUMGoogle Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDEPSS 1.1%CVE-2024-41357HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.EPSS 1.1%CVE-2022-46870MEDIUMApache Zeppelin: Stored XSS in note permissionsEPSS 1.1%CVE-2016-9465—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image exEPSS 1.1%CVE-2022-1167—CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site ScriptingEPSS 1.1%