Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-29206CRITICALorg.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsEPSS 0.9%CVE-2022-1250—LifterLMS PayPal < 1.4.0 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-36108MEDIUMCross-Site Scripting in typo3/cms-coreEPSS 0.9%CVE-2023-28120MEDIUMThere is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.EPSS 0.9%CVE-2018-10934MEDIUMA cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles tEPSS 0.9%CVE-2020-25163HIGHOSIsoft PI Vision Cross-site ScriptingEPSS 0.9%CVE-2026-55034HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2026-96230HIGHASP.NET Core Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-55021HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-39338MEDIUMMyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-22571—An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all EPSS 0.9%CVE-2022-2932CRITICALCross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kitEPSS 0.9%CVE-2022-3072HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2019-10177MEDIUMA stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user inEPSS 0.9%CVE-2022-40956MEDIUMWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. EPSS 0.9%CVE-2013-4170—In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, theEPSS 0.9%CVE-2021-24808—BP Better Messages < 1.9.9.41 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2020-8294—A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet ExplorerEPSS 0.9%CVE-2021-21365MEDIUMCross-Site Scripting in Content RenderingEPSS 0.9%CVE-2022-39331MEDIUMCross-site Scripting (XSS) in Nexcloud Desktop ClientEPSS 0.9%