Weaknesses of type CWE-79

28,634 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-21686HIGHThis High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerabiEPSS 0.9%CVE-2024-43476HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%CVE-2021-27658MEDIUMexacqVision Enterprise Manager CSSEPSS 0.9%CVE-2021-4143HIGHCross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebuttonEPSS 0.9%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-39366MEDIUMStored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in CactiEPSS 0.9%CVE-2024-53255MEDIUMReflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMSEPSS 0.9%CVE-2021-24724—Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-2036CRITICALCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2022-1029—Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site ScriptingEPSS 0.9%CVE-2021-25062—Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25015—myCred < 2.4 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25031—Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-43855HIGHStored XSS via SVG in Requarks/wikiEPSS 0.9%CVE-2020-36635LOWOpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scriptingEPSS 0.9%CVE-2023-28665MEDIUMThe Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page'EPSS 0.9%CVE-2024-45714MEDIUMSolarWinds Serv-U Stored XSS VulnerabilityEPSS 0.9%CVE-2023-21564HIGHAzure DevOps Server Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2021-25035—Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2017-16721—A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unaEPSS 0.9%