Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-41311MEDIUMA stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2EPSS 1.0%CVE-2022-23397MEDIUMThe Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent EPSS 1.0%CVE-2007-5817MEDIUMdialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1) del, (2) delbackupEPSS 1.0%CVE-2024-20759HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 1.0%CVE-2020-26239HIGHCross-Site Scripting in Scratch browser addonsEPSS 1.0%CVE-2023-26982MEDIUMTrudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create TickeEPSS 1.0%CVE-2024-30920HIGHCross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.phpEPSS 1.0%CVE-2022-44951MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.phEPSS 1.0%CVE-2026-83662CRITICALAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.0%CVE-2026-22704HIGHHAXcms Has Stored XSS Vulnerability that May Lead to Account TakeoverEPSS 1.0%CVE-2021-41139HIGHReflected XSS vulnerability in time.phpEPSS 1.0%CVE-2020-2496—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2022-3572CRITICALA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, andEPSS 1.0%CVE-2022-42118MEDIUMA Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixEPSS 1.0%CVE-2024-25412MEDIUMA cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 1.0%CVE-2021-41172MEDIUMSelf-XSS in AS_RedisEPSS 1.0%CVE-2020-8170—We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AiEPSS 1.0%CVE-2021-25929MEDIUMIn OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through EPSS 1.0%CVE-2022-34257MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 1.0%CVE-2024-22927MEDIUMCross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedEPSS 1.0%