Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2023-25833MEDIUMBUG-000155004 HTML injection issue in Portal for ArcGIS.EPSS 0.4%CVE-2023-32193HIGHNorman API Cross-site Scripting VulnerabilityEPSS 0.4%CVE-2022-39372LOWStored Cross-Site Scripting (XSS) in user information in GLPIEPSS 0.4%CVE-2024-37166HIGHghtml Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-57730MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureEPSS 0.4%CVE-2024-32464MEDIUMActionText ContentAttachment can Contain Unsanitized HTMLEPSS 0.4%CVE-2024-52300CRITICALmacro-pdfviewer has a XSS through the width parameterEPSS 0.4%CVE-2024-8872MEDIUMStore Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-1606MEDIUMHTML injection in BMC Control-MEPSS 0.4%CVE-2026-73238MEDIUMApache Allura: XSS in code displayEPSS 0.4%CVE-2026-73237MEDIUMApache Allura: XSS in markdown pipelineEPSS 0.4%CVE-2023-40557MEDIUMWordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerabilityEPSS 0.4%CVE-2023-39161MEDIUMWordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-6108MEDIUMGenexis Tilgin Home Gateway Login cross site scriptingEPSS 0.4%CVE-2023-0007MEDIUMPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web InterfaceEPSS 0.4%CVE-2026-57534LOWStored XSS in pretix-pagesEPSS 0.4%CVE-2026-13314LOWStored XSS in pretix-digitalEPSS 0.4%CVE-2026-57532HIGHMalicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in EPSS 0.4%CVE-2024-24571MEDIUMfacileManager Systemic Cross-Site Scripting (XSS)EPSS 0.4%