Weaknesses of type CWE-79

30,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-2101MEDIUMDownload Manager <= 3.2.46 - Contributor+ Cross-Site ScriptingEPSS 1.1%CVE-2021-32696LOWPassing in a non-string 'html' argument can lead to unsanitized outputEPSS 1.1%CVE-2021-39344MEDIUMKJM Admin Notices <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.1%CVE-2018-15455MEDIUMCisco Identity Services Engine Logging Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-0929MEDIUMXSS on dynamic_text module in microweber/microweberEPSS 1.1%CVE-2023-4203CRITICALStored Cross-Site ScriptingEPSS 1.1%CVE-2024-21419HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.1%CVE-2021-25065—Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.1%CVE-2018-10937MEDIUMA cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to crEPSS 1.1%CVE-2022-35651—A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM trEPSS 1.1%CVE-2024-6516CRITICALCross Site Scripting XSSEPSS 1.1%CVE-2022-2826LOWAn issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.1EPSS 1.1%CVE-2023-50891MEDIUMWordPress Zoho Forms Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 1.1%CVE-2021-39199CRITICALCross site scripting via unsafe defaults in remark-htmlEPSS 1.1%CVE-2019-7000MEDIUMAvaya Aura Conferencing XSSEPSS 1.1%CVE-2021-35240MEDIUMStored XSS via Help Server settingsEPSS 1.1%CVE-2018-14664MEDIUMA flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code inEPSS 1.1%CVE-2024-23349MEDIUMApache Answer: XSS vulnerability when submitting summaryEPSS 1.1%CVE-2020-3583MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.1%CVE-2024-28715HIGHCross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functioEPSS 1.1%