Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-52773MEDIUMReflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWikiEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2021-29467MEDIUMSelf-XSSEPSS 0.5%CVE-2022-39371HIGHStored Cross-Site Scripting (XSS) through asset inventory in GLPIEPSS 0.5%CVE-2022-39301HIGHsra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file uploadEPSS 0.5%CVE-2025-22274LOWHTML injection in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2024-25690MEDIUMHTML injection in ArcGIS Web AppBuilderEPSS 0.5%CVE-2026-57167MEDIUMPeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.5%CVE-2021-28803—Stored XSS Vulnerability in Q'centerEPSS 0.5%CVE-2022-1293MEDIUMXSS vulnerability in CitadelEPSS 0.5%CVE-2023-20222MEDIUMA vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2024-51735HIGHStored Cross-site Scripting to RCE on Osmedeus Web ServerEPSS 0.5%CVE-2017-20061MEDIUMElefant CMS extended Reflected cross site scritingEPSS 0.5%CVE-2024-32746MEDIUMA cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or EPSS 0.5%CVE-2023-20218MEDIUMA vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remoEPSS 0.5%CVE-2024-38859MEDIUMXSS in view page with SLA columnEPSS 0.4%CVE-2024-8145MEDIUMClassCMS Article admin cross site scriptingEPSS 0.4%CVE-2022-46350MEDIUMA vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALAEPSS 0.4%CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%