Weaknesses of type CWE-79

30,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-31127HIGHImproper handling of email input in next-authEPSS 1.1%CVE-2021-40714MEDIUMAdobe Experience Manager Reflected Cross Site Scripting via accesskey parameterEPSS 1.1%CVE-2021-24310—Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery TitleEPSS 1.1%CVE-2024-28160HIGHJenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingEPSS 1.1%CVE-2024-45061HIGHA cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTEPSS 1.1%CVE-2021-32478—The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versioEPSS 1.1%CVE-2022-44946MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?moduleEPSS 1.1%CVE-2007-5954MEDIUMCross-site scripting (XSS) vulnerability in buscador.php in JLMForo System allows remote attackers to inject arbitrary web script or HTML viEPSS 1.1%CVE-2019-18578CRITICALDell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of EPSS 1.1%CVE-2020-12517HIGHPhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).EPSS 1.1%CVE-2021-24833—YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview ModuleEPSS 1.1%CVE-2021-29459CRITICALXSS Cross Site ScriptingEPSS 1.1%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2023-5244MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.1%CVE-2021-21079MEDIUMAdobe Connect Reflected Cross-site Scripting via archiveOffset parameterEPSS 1.1%CVE-2021-25067—Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.1%CVE-2022-45064HIGHApache Sling Engine: Include-based XSSEPSS 1.1%CVE-2024-41357HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.EPSS 1.1%CVE-2022-1167—CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site ScriptingEPSS 1.1%CVE-2016-9465—Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image exEPSS 1.1%