Weaknesses of type CWE-79

28,608 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-24722HIGHCross-site Scripting in view_componentEPSS 1.1%CVE-2024-7124MEDIUMReflected XSS in DInGO dLibraEPSS 1.1%CVE-2021-25067—Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.1%CVE-2021-24526—Form Maker < 1.13.60 - Authenticated Stored XSSEPSS 1.1%CVE-2023-2341HIGHCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 1.1%CVE-2023-51633HIGHCentreon sysName Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.1%CVE-2019-6565—Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attackEPSS 1.1%CVE-2022-40434CRITICALSoftr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.EPSS 1.1%CVE-2022-39048MEDIUMCross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirectEPSS 1.1%CVE-2021-40272MEDIUMOP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).EPSS 1.1%CVE-2022-42711CRITICALIn Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could alEPSS 1.1%CVE-2023-45144CRITICALRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki AppEPSS 1.1%CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2024-29882HIGHSRS DOM - XSS on JSONP callbackEPSS 1.1%CVE-2017-12221—A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-sEPSS 1.1%CVE-2021-24135—WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSSEPSS 1.1%CVE-2022-41445MEDIUMA cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripEPSS 1.1%CVE-2024-5737MEDIUMHTML Injection in AdmirorFrames Joomla! ExtensionEPSS 1.1%CVE-2022-41312MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.1%CVE-2022-46934MEDIUMkkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewConEPSS 1.1%