Weaknesses of type CWE-79

28,612 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-1559—Clipr <= 1.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.0%CVE-2020-2494—Cross-site Scripting Vulnerability in Music StationEPSS 1.0%CVE-2020-2491—Cross-site Scripting Vulnerability in Photo StationEPSS 1.0%CVE-2024-30047HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2022-4865HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.0%CVE-2022-4866CRITICALCross-site Scripting (XSS) - Stored in usememos/memosEPSS 1.0%CVE-2023-25837HIGHBUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.EPSS 1.0%CVE-2024-30048HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2017-8440—Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtainEPSS 1.0%CVE-2017-8439—Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker toEPSS 1.0%CVE-2021-39356MEDIUMContent Staging <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-1504MEDIUMXSS in /demo/module/?module=HERE in microweber/microweberEPSS 1.0%CVE-2021-39355MEDIUMIndeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-23598MEDIUMReflected XSS vulnerability when rendering error messages in laminas-formEPSS 1.0%CVE-2024-11325MEDIUMAWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-4636MEDIUMWordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.0%CVE-2021-33611MEDIUMReflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14EPSS 1.0%CVE-2015-20105—ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site ScriptingEPSS 1.0%CVE-2023-5538HIGHMpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2019-10178MEDIUMIt was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored CroEPSS 1.0%