Weaknesses of type CWE-79

30,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-21394HIGHDynamics 365 Field Service Spoofing VulnerabilityEPSS 1.1%CVE-2022-33322MEDIUMCross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEEPSS 1.1%CVE-2021-24153—Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 1.1%CVE-2024-48652MEDIUMCross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name fieldEPSS 1.1%CVE-2022-2089—Bold Page Builder < 4.3.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-1820MEDIUMKeep Backup Daily <= 2.0.2 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2019-14881MEDIUMA vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.EPSS 1.1%CVE-2022-1822MEDIUMZephyr Project Manager <= 3.2.40 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-45038MEDIUMA cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts EPSS 1.1%CVE-2022-45037MEDIUMA cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts orEPSS 1.1%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2022-0157MEDIUMCross-site Scripting (XSS) - Stored in phoronix-test-suite/phoronix-test-suiteEPSS 1.1%CVE-2019-12644MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2021-32681MEDIUMImproper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksEPSS 1.1%CVE-2022-21719MEDIUMReflected XSS using reload button in GLPIEPSS 1.1%CVE-2019-3754MEDIUMDell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe320EPSS 1.1%CVE-2021-24985—Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site ScriptingEPSS 1.1%CVE-2022-23133MEDIUMStored XSS in host groups configuration window in Zabbix FrontendEPSS 1.1%CVE-2021-43761HIGHAdobe Experience Manager Stored XSS on Edit Tag page via Localization inputEPSS 1.1%CVE-2021-32733MEDIUMXSS in Nextcloud Text applicationEPSS 1.1%