Weaknesses of type CWE-79

30,669 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24124—WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)EPSS 1.1%CVE-2020-11083LOWStored XSS in OctoberEPSS 1.1%CVE-2022-3123MEDIUMCross-site Scripting (XSS) - Reflected in splitbrain/dokuwikiEPSS 1.1%CVE-2024-50053MEDIUMStored XSSEPSS 1.1%CVE-2020-25715—A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack tEPSS 1.1%CVE-2024-7703MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 1.1%CVE-2022-40434CRITICALSoftr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.EPSS 1.1%CVE-2024-21395HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2021-39178HIGHXSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0EPSS 1.1%CVE-2022-1961MEDIUMGoogle Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDEPSS 1.1%CVE-2020-8155—An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening aEPSS 1.1%CVE-2026-116926HIGHMicrosoft Teams Spoofing VulnerabilityEPSS 1.1%CVE-2022-44957MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulneraEPSS 1.1%CVE-2022-44944MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.phEPSS 1.1%CVE-2021-39349MEDIUMAuthor Bio Box <= 3.3.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-47875CRITICALDOMPurify nesting-based mXSSEPSS 1.1%CVE-2024-11428MEDIUMLazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-1557—ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-21520MEDIUMVersions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fEPSS 1.1%CVE-2021-40714MEDIUMAdobe Experience Manager Reflected Cross Site Scripting via accesskey parameterEPSS 1.1%