Weaknesses of type CWE-79

30,672 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-54958MEDIUMNagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to EPSS 1.0%CVE-2023-30838HIGHPrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML methodEPSS 1.0%CVE-2025-26064HIGHA cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts oEPSS 1.0%CVE-2021-25933MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2024-51135CRITICALAn XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensEPSS 1.0%CVE-2024-23111MEDIUMAn improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and EPSS 1.0%CVE-2023-34222MEDIUMIn JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possibleEPSS 1.0%CVE-2023-34226MEDIUMIn JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleEPSS 1.0%CVE-2023-39175MEDIUMIn JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleEPSS 1.0%CVE-2023-38065MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possibleEPSS 1.0%CVE-2021-28625MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jspEPSS 1.0%CVE-2023-38061MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possibleEPSS 1.0%CVE-2022-1346CRITICALMultiple Stored XSS in causefx/organizrEPSS 1.0%CVE-2021-28628MEDIUMAdobe Experience Manager Cross-site Scripting vulnerability in inbox render.jspEPSS 1.0%CVE-2022-1344CRITICALStored XSS due to no sanitization in the filename in causefx/organizrEPSS 1.0%CVE-2023-34221MEDIUMIn JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possibleEPSS 1.0%CVE-2023-38063MEDIUMIn JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possibleEPSS 1.0%CVE-2023-6697MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2020-26216HIGHCross-Site Scripting in TYPO3 FluidEPSS 1.0%CVE-2022-29091MEDIUMDell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in UnisphEPSS 1.0%