Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2023-29508HIGHorg.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2025-62172HIGHHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity NameEPSS 0.4%CVE-2026-41611HIGHVisual Studio Code Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-47815MEDIUMCross-site Scripting in IncidentReportingEPSS 0.4%CVE-2023-44396MEDIUMiTop vulnerable to XSS in dashlet modifications ajax endpointsEPSS 0.4%CVE-2024-58353CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%CVE-2024-58355CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%CVE-2024-6183MEDIUMEZ-Suite EZ-Partner Forgot Password cross site scriptingEPSS 0.4%CVE-2024-24874MEDIUMWordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-47812MEDIUMCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDumpEPSS 0.4%CVE-2024-56199MEDIUMphpMyFAQ Vulnerable to Stored HTML Injection at FAQEPSS 0.4%CVE-2023-50933MEDIUMIBM PowerSC HTML injectionEPSS 0.4%CVE-2025-36321MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.4%CVE-2023-22309MEDIUMReflected Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23548MEDIUMXSS in business intelligenceEPSS 0.4%CVE-2024-20341MEDIUMCisco Adaptive Security Appliance WebVPN Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-51989HIGHHTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTEPSS 0.4%CVE-2026-57535LOWContent injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these EPSS 0.4%CVE-2024-27716MEDIUMCross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the messagEPSS 0.4%CVE-2026-65841MEDIUMJodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationEPSS 0.4%