Weaknesses of type CWE-79

28,631 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2022-31094HIGHCross site scripting vulnerability in ScratchToolsEPSS 0.9%CVE-2022-30596—A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent EPSS 0.9%CVE-2022-45916MEDIUMILIAS before 7.16 allows XSS.EPSS 0.9%CVE-2024-31063MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.9%CVE-2021-38337MEDIUMRSVPMaker Excel <= 1.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38321MEDIUMCustom Menu Plugin <= 1.3.3 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38334MEDIUMWP Design Maps & Places <= 1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38317MEDIUMKonnichiwa! Membership <= 0.8.3 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-40045HIGHWS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-38322MEDIUMTwitter Friends Widget <= 3.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38338MEDIUMBorder Loading Bar <= 1.0.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34654MEDIUMCustom Post Type Relations <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38339MEDIUMSimple Matted Thumbnails <= 1.01 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34649MEDIUMSimple Behance Portfolio <= 0.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38331MEDIUMWP-T-Wap <= 1.13.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-34667MEDIUMCalendar_plugin <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38318MEDIUM3D Cover Carousel <= 1.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-38329MEDIUMDJ EmailPublish <= 1.7.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-40030MEDIUMMalicious dependencies can inject arbitrary JavaScript into cargo-generated timing reportsEPSS 0.9%