Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-40105MEDIUMXWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionalityEPSS 0.5%CVE-2024-47139MEDIUMF5 BIG-IQ VulnerabilityEPSS 0.5%CVE-2023-3017LOWSourceCodester Lost and Found Information System Manage User Page cross site scriptingEPSS 0.5%CVE-2024-28108MEDIUMphpMyFAQ Stored HTML Injection at contentLinkEPSS 0.5%CVE-2024-32875MEDIUMHugo doesn't escape markdown title in internal render hooksEPSS 0.5%CVE-2017-20085LOWAtahualpa Theme cross site scritingEPSS 0.5%CVE-2018-25039LOWThomson TCW710 RgUrlBlock.asp Persistent cross site scritingEPSS 0.5%CVE-2017-20122LOWBitrix Site Manager Contact Form cross site scriptingEPSS 0.5%CVE-2023-26046MEDIUMteler-waf subject to bypass of common web attack threat rule with HTML entities payloadEPSS 0.5%CVE-2021-32735HIGHCross-site scripting (XSS) from field and configuration text displayed in the PanelEPSS 0.5%CVE-2017-20098LOWAdmin Custom Login Plugin Persistent cross site scriptingEPSS 0.5%CVE-2024-8680MEDIUMMailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-59855HIGHSiYuan: Store XSS To Rce via Asset.renderEPSS 0.5%CVE-2023-20181MEDIUMA vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remoteEPSS 0.5%CVE-2019-19285—A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if EPSS 0.5%CVE-2019-13931—A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow for an an attacker to craft the input inEPSS 0.5%CVE-2024-24807LOWSulu is vulnerable to HTML Injection via Autocomplete SuggestionEPSS 0.5%CVE-2025-23919MEDIUMWordPress Slides & Presentations Plugin <= 0.0.39 - Content Injection vulnerabilityEPSS 0.5%CVE-2023-26047MEDIUMteler-waf contains detection rule bypass via entities payloadEPSS 0.5%CVE-2017-20059LOWElefant CMS Title Persistent cross site scritingEPSS 0.5%