Weaknesses of type CWE-80

646 results

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

O aplicativo web recebe entrada do usuário e a exibe na página sem sanitizar tags HTML/JavaScript, permitindo que um atacante injete scripts maliciosos que executam no navegador da vítima. O risco é roubo de sessões, credenciais, redirecionamento para sites maliciosos ou modificação do conteúdo exibido.

Example

Um campo de busca que mostra 'Você pesquisou por: <script>alert(document.cookie)</script>' sem escapar a entrada. O script executa no navegador de quem clica no link compartilhado, vazando cookies de sessão.

How to mitigate

Sempre escapar (encode) caracteres especiais HTML (< > " &) na saída ou usar bibliotecas de sanitização robustas (DOMPurify, Bleach). Implementar Content Security Policy (CSP) para bloquear scripts inline não-autorizado como camada adicional de defesa.

CVE-2024-8981HIGHBroken Link Checker <= 2.4.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2019-5450—Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in EPSS 0.5%CVE-2003-5003MEDIUMISS BlackICE PC Protection Update cross site scritingEPSS 0.5%CVE-2022-35850MEDIUMAn improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4EPSS 0.5%CVE-2024-33831HIGHA stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute EPSS 0.5%CVE-2024-20362MEDIUMA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could alEPSS 0.5%CVE-2022-1293MEDIUMXSS vulnerability in CitadelEPSS 0.5%CVE-2026-73220HIGHCVAT: Stored XSS via annotation guides in audio tasksEPSS 0.5%CVE-2026-91130CRITICALHome Assistant: XSS in Statistics Graph CardEPSS 0.5%CVE-2026-68919HIGHGoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesEPSS 0.5%CVE-2024-37297MEDIUMWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsEPSS 0.5%CVE-2024-25873MEDIUMEnhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerabEPSS 0.5%CVE-2025-22274LOWHTML injection in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2023-20228MEDIUMA vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteEPSS 0.5%CVE-2021-29467MEDIUMSelf-XSSEPSS 0.5%CVE-2022-46350MEDIUMA vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALAEPSS 0.5%CVE-2024-25690MEDIUMHTML injection in ArcGIS Web AppBuilderEPSS 0.5%CVE-2017-20061MEDIUMElefant CMS extended Reflected cross site scritingEPSS 0.5%CVE-2023-32193HIGHNorman API Cross-site Scripting VulnerabilityEPSS 0.5%