Weaknesses of type CWE-79

30,670 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-23519HIGHPossible XSS vulnerability with certain configurations of rails-html-sanitizerEPSS 1.1%CVE-2022-44947MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?moEPSS 1.1%CVE-2019-13407—Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgiEPSS 1.1%CVE-2022-1320—Sliderby10Web < 1.2.52 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2022-1394—Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-56126MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.phpEPSS 1.1%CVE-2024-57522MEDIUMSourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a EPSS 1.1%CVE-2022-1564—Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2026-56127MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.phpEPSS 1.1%CVE-2026-56128MEDIUMpfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.phpEPSS 1.1%CVE-2022-43425MEDIUMJenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters onEPSS 1.1%CVE-2023-34229MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possibleEPSS 1.0%CVE-2022-44950MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?mEPSS 1.0%CVE-2023-43566LOWIn JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configurationEPSS 1.0%CVE-2026-100133CRITICALAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 1.0%CVE-2022-44949MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?mEPSS 1.0%CVE-2021-43785HIGHCross Site Scripting Vulnerability in @joeattardi/emoji-buttonEPSS 1.0%CVE-2017-0931—html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.EPSS 1.0%CVE-2024-45265CRITICALA SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL cEPSS 1.0%CVE-2024-54959MEDIUMNagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-EPSS 1.0%