Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2017-20085LOWAtahualpa Theme cross site scritingEPSS 0.5%CVE-2017-20122LOWBitrix Site Manager Contact Form cross site scriptingEPSS 0.5%CVE-2021-32735HIGHCross-site scripting (XSS) from field and configuration text displayed in the PanelEPSS 0.5%CVE-2017-20098LOWAdmin Custom Login Plugin Persistent cross site scriptingEPSS 0.5%CVE-2026-65841MEDIUMJodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationEPSS 0.5%CVE-2024-8680MEDIUMMailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2025-64764HIGHAstro is vulnerable to Reflected XSS via the server islands featureEPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2023-20181MEDIUMA vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remoteEPSS 0.5%CVE-2021-37195—A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlEPSS 0.5%CVE-2017-20060LOWElefant CMS Blog Post Persistent cross site scritingEPSS 0.5%CVE-2017-20059LOWElefant CMS Title Persistent cross site scritingEPSS 0.5%CVE-2019-13931—A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow for an an attacker to craft the input inEPSS 0.5%CVE-2019-19285—A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if EPSS 0.5%CVE-2024-24807LOWSulu is vulnerable to HTML Injection via Autocomplete SuggestionEPSS 0.5%CVE-2023-26047MEDIUMteler-waf contains detection rule bypass via entities payloadEPSS 0.5%CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2025-62198MEDIUMApache Atlas: Stored XSS in Create Entity pageEPSS 0.5%CVE-2022-39372LOWStored Cross-Site Scripting (XSS) in user information in GLPIEPSS 0.5%CVE-2025-21612HIGHCross-site Scripting in TabberTransclude in Extension:TabberNeueEPSS 0.5%