Falhas do tipo CWE-80

628 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-8872MEDIUMStore Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-1606MEDIUMHTML injection in BMC Control-MEPSS 0.4%CVE-2025-62172HIGHHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity NameEPSS 0.4%CVE-2023-39161MEDIUMWordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerabilityEPSS 0.4%CVE-2023-40557MEDIUMWordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-56199MEDIUMphpMyFAQ Vulnerable to Stored HTML Injection at FAQEPSS 0.4%CVE-2024-6108MEDIUMGenexis Tilgin Home Gateway Login cross site scriptingEPSS 0.4%CVE-2023-0007MEDIUMPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web InterfaceEPSS 0.4%CVE-2024-20341MEDIUMCisco Adaptive Security Appliance WebVPN Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-57532HIGHMalicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in EPSS 0.4%CVE-2026-13314LOWStored XSS in pretix-digitalEPSS 0.4%CVE-2026-57534LOWStored XSS in pretix-pagesEPSS 0.4%CVE-2024-24571MEDIUMfacileManager Systemic Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-29508HIGHorg.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2026-41611HIGHVisual Studio Code Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-40873HIGHmailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenamesEPSS 0.4%CVE-2025-53093HIGHTabberNeue vulnerable to Stored XSS through wikitextEPSS 0.4%CVE-2024-47815MEDIUMCross-site Scripting in IncidentReportingEPSS 0.4%CVE-2023-44396MEDIUMiTop vulnerable to XSS in dashlet modifications ajax endpointsEPSS 0.4%CVE-2024-58353CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%