Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-24131MEDIUMSuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.EPSS 0.9%CVE-2022-35739MEDIUMPRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary conteEPSS 0.9%CVE-2023-33255MEDIUMAn issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web apEPSS 0.9%CVE-2022-41391CRITICALOcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.EPSS 0.9%CVE-2017-16019—GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-EPSS 0.9%CVE-2018-15451MEDIUMCisco Prime Service Catalog Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2022-2060HIGHCross-site Scripting (XSS) - Stored in dolibarr/dolibarrEPSS 0.9%CVE-2025-28121MEDIUMcode-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing reEPSS 0.9%CVE-2020-3466MEDIUMCisco DNA Center Cross-Site Scripting VulnerabilitiesEPSS 0.9%CVE-2022-36037MEDIUMCross-site scripting (XSS) from dynamic options in the multiselect field in KirbyEPSS 0.9%CVE-2024-27082HIGHCacti Cross-site Scripting vulnerability when managing treesEPSS 0.9%CVE-2021-27442CRITICALWeintek EasyWeb cMT Cross-site ScriptingEPSS 0.9%CVE-2024-32391HIGHCross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.EPSS 0.9%CVE-2022-43499MEDIUMStored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administratiEPSS 0.9%CVE-2022-31094HIGHCross site scripting vulnerability in ScratchToolsEPSS 0.9%CVE-2022-30119—XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitatEPSS 0.9%CVE-2022-30118—Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet ExploEPSS 0.9%CVE-2022-2890CRITICALCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.9%CVE-2022-1208MEDIUMUltimate Member <= 2.3.2 - Stored Cross-Site ScriptingEPSS 0.9%CVE-2023-3521MEDIUMCross-site Scripting (XSS) - Reflected in fossbilling/fossbillingEPSS 0.9%