Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2017-20060LOWElefant CMS Blog Post Persistent cross site scritingEPSS 0.5%CVE-2021-37195—A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlEPSS 0.5%CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.5%CVE-2025-21612HIGHCross-site Scripting in TabberTransclude in Extension:TabberNeueEPSS 0.5%CVE-2025-62198MEDIUMApache Atlas: Stored XSS in Create Entity pageEPSS 0.5%CVE-2023-5582LOWZZZCMS Personal Profile Page cross site scriptingEPSS 0.5%CVE-2024-8981HIGHBroken Link Checker <= 2.4.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-46722MEDIUMPimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewsEPSS 0.5%CVE-2019-5450—Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in EPSS 0.5%CVE-2003-5003MEDIUMISS BlackICE PC Protection Update cross site scritingEPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-35850MEDIUMAn improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4EPSS 0.5%CVE-2024-33831HIGHA stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute EPSS 0.5%CVE-2025-64764HIGHAstro is vulnerable to Reflected XSS via the server islands featureEPSS 0.5%CVE-2024-20362MEDIUMA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could alEPSS 0.5%CVE-2024-37297MEDIUMWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsEPSS 0.5%CVE-2024-25873MEDIUMEnhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerabEPSS 0.5%CVE-2025-54414MEDIUMAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttonsEPSS 0.5%CVE-2023-20228MEDIUMA vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteEPSS 0.5%