Weaknesses of type CWE-79

28,608 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-0931—html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.EPSS 1.1%CVE-2017-15888—Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticatEPSS 1.1%CVE-2020-3583MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2022-41224MEDIUMJenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the JenkinsEPSS 1.1%CVE-2023-5244MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.1%CVE-2024-22397HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticaEPSS 1.1%CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%CVE-2020-15092HIGHStored XSS in TimelineJS3EPSS 1.1%CVE-2024-27285MEDIUMYARD's default template vulnerable to Cross-site Scripting in generated frames.htmlEPSS 1.1%CVE-2023-1315MEDIUMCross-site Scripting (XSS) - Reflected in osticket/osticketEPSS 1.1%CVE-2021-22878—Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`EPSS 1.1%CVE-2021-35238MEDIUMStored XSS through URL POST parameter in CreateExternalWebsite VulnerabilityEPSS 1.1%CVE-2017-2607MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). JenkinEPSS 1.1%CVE-2019-12716MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12695MEDIUMCisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1852MEDIUMCisco Prime Network Registrar Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12712MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1931MEDIUMCisco Firepower Management Center RSS Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2022-48426MEDIUMIn JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possibleEPSS 1.1%CVE-2019-12631MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%