Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2023-41048LOWplone.namedfile vulnerable to Stored Cross Site Scripting with SVG imagesEPSS 0.6%CVE-2023-5582LOWZZZCMS Personal Profile Page cross site scriptingEPSS 0.6%CVE-2022-25756—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 0.6%CVE-2024-32472MEDIUMexcalidraw vulnerable to a Stored XSS in excalidraw's web embed componentEPSS 0.6%CVE-2026-48910MEDIUMApache JSPWiki: Markdown parser allows XSS injection in Markdown error processingEPSS 0.6%CVE-2024-33423HIGHCross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML viEPSS 0.6%CVE-2024-23817HIGHDolibarr Application Home Page HTML injection vulnerabilityEPSS 0.6%CVE-2022-39301HIGHsra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file uploadEPSS 0.6%CVE-2026-24128MEDIUMXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error MessagesEPSS 0.6%CVE-2024-0183LOWRRJ Nueva Ecija Engineer Online Portal NIA Office students.php cross site scriptingEPSS 0.5%CVE-2024-34699MEDIUMGZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.EPSS 0.5%CVE-2026-40105MEDIUMXWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionalityEPSS 0.5%CVE-2023-3017LOWSourceCodester Lost and Found Information System Manage User Page cross site scriptingEPSS 0.5%CVE-2022-39371HIGHStored Cross-Site Scripting (XSS) through asset inventory in GLPIEPSS 0.5%CVE-2018-25039LOWThomson TCW710 RgUrlBlock.asp Persistent cross site scritingEPSS 0.5%CVE-2025-23919MEDIUMWordPress Slides & Presentations Plugin <= 0.0.39 - Content Injection vulnerabilityEPSS 0.5%CVE-2024-28108MEDIUMphpMyFAQ Stored HTML Injection at contentLinkEPSS 0.5%CVE-2026-52741HIGHGoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesEPSS 0.5%CVE-2024-32875MEDIUMHugo doesn't escape markdown title in internal render hooksEPSS 0.5%CVE-2023-26046MEDIUMteler-waf subject to bypass of common web attack threat rule with HTML entities payloadEPSS 0.5%