Weaknesses of type CWE-79

29,965 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-44025MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.EPSS 0.4%CVE-2022-44027MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6.EPSS 0.4%CVE-2024-2347MEDIUMAstra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameEPSS 0.4%CVE-2024-40738HIGHA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-40736MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-38711HIGHWordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-57556MEDIUMCross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deepEPSS 0.4%CVE-2023-29791MEDIUMkodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.EPSS 0.4%CVE-2023-32597HIGHWordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-4411MEDIUMMihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2022-47701MEDIUMCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSSEPSS 0.4%CVE-2026-102982HIGHPlane: XSS in work item commentsEPSS 0.4%CVE-2024-2845MEDIUMBetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-5060MEDIUMLottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-71233HIGHInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldEPSS 0.4%CVE-2022-4771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') EPSS 0.4%CVE-2023-2139MEDIUMReflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 EPSS 0.4%CVE-2023-5562MEDIUMUnsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business HubEPSS 0.4%CVE-2024-9116MEDIUMMonkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-7918MEDIUMPocket Widget <= 0.1.3 - Admin+ Stored XSSEPSS 0.4%