Weaknesses of type CWE-79

28,608 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-12712MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-1852MEDIUMCisco Prime Network Registrar Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12631MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12715MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-12713MEDIUMCisco Prime Infrastructure Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2022-44957MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulneraEPSS 1.1%CVE-2020-3156MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2019-13407—Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgiEPSS 1.1%CVE-2026-56128MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.phpEPSS 1.1%CVE-2026-56127MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.phpEPSS 1.1%CVE-2026-56126MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.phpEPSS 1.1%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.1%CVE-2021-25065—Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 1.0%CVE-2023-43566LOWIn JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configurationEPSS 1.0%CVE-2022-44946MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?moduleEPSS 1.0%CVE-2021-43785HIGHCross Site Scripting Vulnerability in @joeattardi/emoji-buttonEPSS 1.0%CVE-2022-35651—A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM trEPSS 1.0%CVE-2024-45265CRITICALA SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL cEPSS 1.0%CVE-2022-43185MEDIUMA stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbEPSS 1.0%CVE-2024-54958MEDIUMNagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to EPSS 1.0%