Weaknesses of type CWE-80

646 results

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

O aplicativo web recebe entrada do usuário e a exibe na página sem sanitizar tags HTML/JavaScript, permitindo que um atacante injete scripts maliciosos que executam no navegador da vítima. O risco é roubo de sessões, credenciais, redirecionamento para sites maliciosos ou modificação do conteúdo exibido.

Example

Um campo de busca que mostra 'Você pesquisou por: <script>alert(document.cookie)</script>' sem escapar a entrada. O script executa no navegador de quem clica no link compartilhado, vazando cookies de sessão.

How to mitigate

Sempre escapar (encode) caracteres especiais HTML (< > " &) na saída ou usar bibliotecas de sanitização robustas (DOMPurify, Bleach). Implementar Content Security Policy (CSP) para bloquear scripts inline não-autorizado como camada adicional de defesa.

CVE-2025-22501HIGHWordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59573MEDIUMWordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection VulnerabilityEPSS 0.2%CVE-2025-11987MEDIUMVisual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview ShortcodeEPSS 0.2%CVE-2024-49343MEDIUMIBM Informix Dynamic Server HTML injectionEPSS 0.2%CVE-2026-40875HIGHmailcow: dockerized vulnerable to stored XSS in user login history real_ripEPSS 0.2%CVE-2026-119492MEDIUMWordPress Ditty plugin <= 3.1.71 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-123471MEDIUMWordPress myCred plugin <= 4.0.2 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-119478MEDIUMWordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-120852MEDIUMWordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-119490MEDIUMWordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-119494MEDIUMWordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-23528MEDIUMDask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and DashboardEPSS 0.2%CVE-2025-60244HIGHWordPress TableOn plugin <= 1.0.5.1 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-27155MEDIUMIn-memory stored Cross-site scripting (XSS) vulnerability in pineconesimEPSS 0.2%CVE-2026-34497MEDIUMFMS Employee Vulnerable to HTML InjectionEPSS 0.2%CVE-2026-111040MEDIUMMultiple vulnerabilities in Coupa’s Total Spend Management PlatformEPSS 0.2%CVE-2025-5686MEDIUMPaged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14735MEDIUMAmazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-46492HIGHmd-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)EPSS 0.2%CVE-2025-11745MEDIUMAd Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldEPSS 0.2%