Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-25837HIGHBUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.EPSS 1.0%CVE-2022-44952MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatioEPSS 1.0%CVE-2024-30047HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2024-30048HIGHDynamics 365 Customer Insights Spoofing VulnerabilityEPSS 1.0%CVE-2017-8440—Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtainEPSS 1.0%CVE-2017-8439—Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker toEPSS 1.0%CVE-2021-39355MEDIUMIndeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2021-39356MEDIUMContent Staging <= 2.0.1 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-23598MEDIUMReflected XSS vulnerability when rendering error messages in laminas-formEPSS 1.0%CVE-2022-1504MEDIUMXSS in /demo/module/?module=HERE in microweber/microweberEPSS 1.0%CVE-2022-48426MEDIUMIn JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possibleEPSS 1.0%CVE-2023-4636MEDIUMWordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-31035CRITICALExternal URLs for Deployments can include javascript in argo-cdEPSS 1.0%CVE-2022-2685LOWSourceCodester Interview Management System addQuestion.php cross site scriptingEPSS 1.0%CVE-2024-51187MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2024-51190MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2021-33611MEDIUMReflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14EPSS 1.0%CVE-2024-51189MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2024-51188MEDIUMTRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via tEPSS 1.0%CVE-2020-2497—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%