Falhas do tipo CWE-80

628 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-57167MEDIUMPeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.5%CVE-2021-28803—Stored XSS Vulnerability in Q'centerEPSS 0.5%CVE-2023-20222MEDIUMA vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2024-52300CRITICALmacro-pdfviewer has a XSS through the width parameterEPSS 0.5%CVE-2024-51735HIGHStored Cross-site Scripting to RCE on Osmedeus Web ServerEPSS 0.5%CVE-2024-32746MEDIUMA cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or EPSS 0.5%CVE-2023-20218MEDIUMA vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remoEPSS 0.5%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-19988MEDIUMAlaev SEO Tools Extension Popup UI popup.html addDiv cross site scriptingEPSS 0.4%CVE-2024-8145MEDIUMClassCMS Article admin cross site scriptingEPSS 0.4%CVE-2024-38859MEDIUMXSS in view page with SLA columnEPSS 0.4%CVE-2023-36555LOWAn improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to exeEPSS 0.4%CVE-2022-25620LOWStored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2023-25833MEDIUMBUG-000155004 HTML injection issue in Portal for ArcGIS.EPSS 0.4%CVE-2023-20179MEDIUMA vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenEPSS 0.4%CVE-2024-37166HIGHghtml Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-57730MEDIUMIn JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureEPSS 0.4%CVE-2024-32464MEDIUMActionText ContentAttachment can Contain Unsanitized HTMLEPSS 0.4%