Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2021-39328MEDIUMSimple Job Board <= 2.9.4 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-39357MEDIUMLeaky Paywall <= 4.16.5 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2015-20019—Content text slider on post < 6.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.9%CVE-2022-0719HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 0.9%CVE-2020-8292—Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in messagEPSS 0.9%CVE-2026-51133MEDIUMCross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary codEPSS 0.9%CVE-2021-41086HIGHClipboard-based XSS in jsuitesEPSS 0.9%CVE-2018-18997—Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrativEPSS 0.9%CVE-2022-4212MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfEPSS 0.9%CVE-2017-20008—myCRED < 1.7.8 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-3850MEDIUMUniview NVR301-04S2-P4 Cross-site ScriptingEPSS 0.9%CVE-2022-4208MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefEPSS 0.9%CVE-2022-3873MEDIUMCross-site Scripting (XSS) - DOM in jgraph/drawioEPSS 0.9%CVE-2022-4209MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfEPSS 0.9%CVE-2022-4210MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfEPSS 0.9%CVE-2022-4211MEDIUMChained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfEPSS 0.9%CVE-2022-2407—WP phpMyAdmin < 5.2.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-26105—SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unautheEPSS 0.9%CVE-2018-3755—XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element uEPSS 0.9%