Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-2497—Cross-site scripting vulnerability in QTS and QuTS heroEPSS 1.0%CVE-2020-25628—The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7EPSS 1.0%CVE-2020-8176—A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shopEPSS 1.0%CVE-2017-16010—i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will EPSS 1.0%CVE-2021-4288LOWOpenMRS openmrs-module-referenceapplication userApp.gsp cross site scriptingEPSS 1.0%CVE-2022-44948MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?moEPSS 1.0%CVE-2020-1721—A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID duEPSS 1.0%CVE-2024-30929HIGHCross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlisEPSS 1.0%CVE-2022-1782CRITICALCross-site Scripting (XSS) - Generic in erudika/paraEPSS 1.0%CVE-2021-4291LOWOpenMRS Admin UI Module location.gsp cross site scriptingEPSS 1.0%CVE-2021-4292LOWOpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scriptingEPSS 1.0%CVE-2019-10178MEDIUMIt was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored CroEPSS 1.0%CVE-2023-43091CRITICALGnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.jsonEPSS 1.0%CVE-2024-34064MEDIUMJinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterEPSS 1.0%CVE-2018-14784—NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable to several cross-sitEPSS 1.0%CVE-2025-2127MEDIUMJoomlaUX JUX Real Estate realties cross site scriptingEPSS 1.0%CVE-2022-0565HIGHCross-site Scripting in pimcore/pimcoreEPSS 1.0%CVE-2021-39346MEDIUMGoogle Maps Easy <= 1.9.33 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2023-4202CRITICALStored Cross-Site ScriptingEPSS 1.0%CVE-2022-4215MEDIUMChained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via dateEPSS 1.0%