Weaknesses of type CWE-80

646 results

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

O aplicativo web recebe entrada do usuário e a exibe na página sem sanitizar tags HTML/JavaScript, permitindo que um atacante injete scripts maliciosos que executam no navegador da vítima. O risco é roubo de sessões, credenciais, redirecionamento para sites maliciosos ou modificação do conteúdo exibido.

Example

Um campo de busca que mostra 'Você pesquisou por: <script>alert(document.cookie)</script>' sem escapar a entrada. O script executa no navegador de quem clica no link compartilhado, vazando cookies de sessão.

How to mitigate

Sempre escapar (encode) caracteres especiais HTML (< > " &) na saída ou usar bibliotecas de sanitização robustas (DOMPurify, Bleach). Implementar Content Security Policy (CSP) para bloquear scripts inline não-autorizado como camada adicional de defesa.

CVE-2026-35460MEDIUMPapra has an HTML Injection in Transactional Emails via Unescaped User Display NameEPSS 0.2%CVE-2026-35163MEDIUMOctoPrint: XSS in Suppressed Command NotificationsEPSS 0.2%CVE-2025-36230MEDIUMXSS in IBM Aspera FaspexEPSS 0.2%CVE-2026-27166MEDIUMDiscourse vulnerable to HTML injection via prohibited iframe URLsEPSS 0.2%CVE-2026-1282LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2025-36397MEDIUMSecurity vulnerabilities have been found in IBM Application GatewayEPSS 0.2%CVE-2025-10128MEDIUMEulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-39837MEDIUMStored XSS through the dynamic table format in CargoEPSS 0.2%CVE-2026-39733MEDIUMWordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-76563MEDIUMHTML Injection in FileorbisEPSS 0.2%CVE-2026-123469MEDIUMWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-123483MEDIUMWordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-48884MEDIUMGalette is vulnerable to XSS through Document TypeEPSS 0.2%CVE-2025-22402LOWDell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page EPSS 0.2%CVE-2025-14289MEDIUMIBM webMethods Integration Server is vulnerable to HTML injectionEPSS 0.2%CVE-2026-10511MEDIUMJupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' ParameterEPSS 0.2%CVE-2026-11511MEDIUMBolt CMS HTML Attribute TextType.php HTML injectionEPSS 0.2%CVE-2026-2995HIGHImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2026-39839MEDIUMStored XSS through URLs in Cargo's map formatEPSS 0.2%CVE-2026-1564MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%