Weaknesses of type CWE-79

30,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-24722HIGHCross-site Scripting in view_componentEPSS 1.1%CVE-2024-7124MEDIUMReflected XSS in DInGO dLibraEPSS 1.1%CVE-2021-24526—Form Maker < 1.13.60 - Authenticated Stored XSSEPSS 1.1%CVE-2023-40355MEDIUMCross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, alloEPSS 1.1%CVE-2023-51633HIGHCentreon sysName Cross-Site Scripting Remote Code Execution VulnerabilityEPSS 1.1%CVE-2023-2341HIGHCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 1.1%CVE-2024-11199MEDIUMRescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar ShortcodeEPSS 1.1%CVE-2022-39048MEDIUMCross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirectEPSS 1.1%CVE-2019-6565—Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attackEPSS 1.1%CVE-2021-21441HIGHXSS in the ticket overview screensEPSS 1.1%CVE-2017-20192HIGHFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2017-12221—A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-sEPSS 1.1%CVE-2024-29882HIGHSRS DOM - XSS on JSONP callbackEPSS 1.1%CVE-2021-24135—WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSSEPSS 1.1%CVE-2024-5737MEDIUMHTML Injection in AdmirorFrames Joomla! ExtensionEPSS 1.1%CVE-2022-41312MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.1%CVE-2022-46934MEDIUMkkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewConEPSS 1.1%CVE-2022-41313MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.1%CVE-2026-54645MEDIUMCubeCart: Stored XSS in Product Description Editor via Global Sanitizer BypassEPSS 1.1%CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%