Falhas do tipo CWE-80

626 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-8981HIGHBroken Link Checker <= 2.4.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2019-5450—Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in EPSS 0.5%CVE-2003-5003MEDIUMISS BlackICE PC Protection Update cross site scritingEPSS 0.5%CVE-2022-35850MEDIUMAn improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4EPSS 0.5%CVE-2024-33831HIGHA stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute EPSS 0.5%CVE-2024-20362MEDIUMA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could alEPSS 0.5%CVE-2022-1293MEDIUMXSS vulnerability in CitadelEPSS 0.5%CVE-2026-73220HIGHCVAT: Stored XSS via annotation guides in audio tasksEPSS 0.5%CVE-2026-68919HIGHGoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesEPSS 0.5%CVE-2026-91130CRITICALHome Assistant: XSS in Statistics Graph CardEPSS 0.5%CVE-2024-37297MEDIUMWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsEPSS 0.5%CVE-2024-25873MEDIUMEnhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerabEPSS 0.5%CVE-2025-22274LOWHTML injection in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2023-20228MEDIUMA vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteEPSS 0.5%CVE-2021-29467MEDIUMSelf-XSSEPSS 0.5%CVE-2022-46350MEDIUMA vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALAEPSS 0.5%CVE-2024-25690MEDIUMHTML injection in ArcGIS Web AppBuilderEPSS 0.5%CVE-2017-20061MEDIUMElefant CMS extended Reflected cross site scritingEPSS 0.5%CVE-2026-57167MEDIUMPeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.5%