Weaknesses of type CWE-83

27 results

Falta de neutralização de URIs perigosas em atributos HTML

A aplicação não remove ou sanitiza corretamente URIs do tipo `javascript:` e similares em atributos perigosos de tags HTML (como `onmouseover`, `onload`, `onerror`, `style`). Isso permite que um atacante injete código JavaScript que executa quando o navegador processa esses atributos, levando a roubo de sessão, redirecionamentos maliciosos ou execução de ações em nome do usuário.

Example

Um site que exibe comentários de usuários sem filtro consegue renderizar `<img src=x onerror="javascript:fetch('/api/steal-token')">` ou `<div style="background: url(javascript:alert(1))">`. Quando a página carrega, o JavaScript dentro desses atributos executa no navegador da vítima.

How to mitigate

Use bibliotecas estabelecidas de sanitização HTML (como DOMPurify em JS ou OWASP ESAPI em Java) que removem atributos e URIs perigosas, ou implemente uma whitelist rigorosa de atributos permitidos por tag. Nunca confie em validação manual ou regex para este caso — sempre use parsing robusto e reconhecido.

CVE-2023-37908CRITICALorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityEPSS 1.1%CVE-2025-4615MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.7%CVE-2023-32070CRITICALImproper Neutralization of Script in Attributes in XWiki (X)HTML renderersEPSS 0.7%CVE-2022-39262MEDIUMStored Cross-Site Scripting (XSS) on login page in GLPIEPSS 0.6%CVE-2020-14525LOWPhilips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PageEPSS 0.5%CVE-2024-52595HIGHHTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%CVE-2023-30958MEDIUMDOM XSS in Developer mode dashboard via redirect GET parameterEPSS 0.4%CVE-2025-0125MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.4%CVE-2025-0137MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.4%CVE-2026-59727LOWAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsEPSS 0.3%CVE-2026-15920MEDIUMPotential cross-site scripting via URLField values in the adminEPSS 0.3%CVE-2026-49276HIGHKirby: Self cross-site scripting (self-XSS) in the writer fieldEPSS 0.3%CVE-2025-58746CRITICALVolkov Labs Business Links plugin vulnerable to privilege escalation attackEPSS 0.3%CVE-2024-26283HIGHAn attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom FEPSS 0.3%CVE-2025-67163MEDIUMA stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML EPSS 0.2%CVE-2024-9103MEDIUMPersistent XSS in blocked messagesEPSS 0.2%CVE-2026-22849HIGHSaleor lacks proper HTML sanitization in rich text fieldsEPSS 0.2%CVE-2026-53722MEDIUMNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLEPSS 0.2%CVE-2026-53841LOWOpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTMLEPSS 0.2%