Weaknesses of type CWE-80

586 results

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

O aplicativo web recebe entrada do usuário e a exibe na página sem sanitizar tags HTML/JavaScript, permitindo que um atacante injete scripts maliciosos que executam no navegador da vítima. O risco é roubo de sessões, credenciais, redirecionamento para sites maliciosos ou modificação do conteúdo exibido.

Example

Um campo de busca que mostra 'Você pesquisou por: <script>alert(document.cookie)</script>' sem escapar a entrada. O script executa no navegador de quem clica no link compartilhado, vazando cookies de sessão.

How to mitigate

Sempre escapar (encode) caracteres especiais HTML (< > " &) na saída ou usar bibliotecas de sanitização robustas (DOMPurify, Bleach). Implementar Content Security Policy (CSP) para bloquear scripts inline não-autorizado como camada adicional de defesa.

CVE-2017-20060LOWElefant CMS Blog Post Persistent cross site scritingEPSS 0.5%CVE-2021-37195—A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlEPSS 0.5%CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.5%CVE-2025-21612HIGHCross-site Scripting in TabberTransclude in Extension:TabberNeueEPSS 0.5%CVE-2025-62198MEDIUMApache Atlas: Stored XSS in Create Entity pageEPSS 0.5%CVE-2023-5582LOWZZZCMS Personal Profile Page cross site scriptingEPSS 0.5%CVE-2024-8981HIGHBroken Link Checker <= 2.4.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-46722MEDIUMPimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewsEPSS 0.5%CVE-2019-5450—Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in EPSS 0.5%CVE-2003-5003MEDIUMISS BlackICE PC Protection Update cross site scritingEPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-35850MEDIUMAn improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4EPSS 0.5%CVE-2024-33831HIGHA stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute EPSS 0.5%CVE-2025-64764HIGHAstro is vulnerable to Reflected XSS via the server islands featureEPSS 0.5%CVE-2024-20362MEDIUMA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could alEPSS 0.5%CVE-2024-37297MEDIUMWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsEPSS 0.5%CVE-2024-25873MEDIUMEnhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerabEPSS 0.5%CVE-2025-54414MEDIUMAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttonsEPSS 0.5%CVE-2023-20228MEDIUMA vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteEPSS 0.5%