Weaknesses of type CWE-87

56 results

Neutralização inadequada de sintaxe alternativa de XSS

A aplicação tenta bloquear ataques XSS filtrando apenas as formas mais óbvias (como <script>), mas não neutraliza variações alternativas da sintaxe HTML/JavaScript que achievem o mesmo resultado. Atacantes usam event handlers (onclick, onerror), protocolos (javascript:), ou tags menos conhecidas (svg, iframe) para injetar código malicioso que o filtro deixa passar.

Example

Um site bloqueia a tag <script> mas aceita <img src=x onerror='alert(1)'>, ou filtra javascript: mas não bloqueia JaVaScRiPt: (variação de caso). Outra variação comum: bloquear <svg onload> mas não <svg><animate onbegin=alert(1)>.

How to mitigate

Use biblioteca anti-XSS consolidada (DOMPurify, OWASP HTML Sanitizer) que trata todas as variações, não filtros caseiros. Melhor ainda: escapeie saídas HTML conforme contexto (HTML entity encoding para conteúdo, atributo encoding para atributos) em vez de tentar listar ataques conhecidos. Valide no servidor e aplique Content Security Policy (CSP) como segunda camada.

CVE-2024-8505MEDIUMWordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label ParameterEPSS 0.4%CVE-2024-4459MEDIUMThemesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TitlesEPSS 0.3%CVE-2025-14732MEDIUMElementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIEPSS 0.3%CVE-2024-25640MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-webEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2024-3519MEDIUMMedia Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langEPSS 0.3%CVE-2024-2618MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2750MEDIUMExclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.3%CVE-2024-3162MEDIUMJeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via TestimonialEPSS 0.3%CVE-2026-55237HIGHAutoGPT SignUp Page has DOM-Based XSS and Open RedirectEPSS 0.3%CVE-2023-6446MEDIUMCalculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-50712MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-web EPSS 0.3%CVE-2026-22711MEDIUMStored XSS through system messages in WikiLoveEPSS 0.3%CVE-2025-62414MEDIUMbagisto - Cross Site Scripting (XSS) in Create New CustomerEPSS 0.3%CVE-2025-62415MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)EPSS 0.3%CVE-2025-62418MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)EPSS 0.3%CVE-2025-49137HIGHHax CMS Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2024-3666MEDIUMOpal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-42458MEDIUMMagento LTS: Reflected XSS - Import -> Data Flow (profiles)EPSS 0.3%