Falhas do tipo CWE-80

630 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-54421HIGHNamelessMC allows Stored Cross Site Scripting (XSS) in SEO componentEPSS 0.4%CVE-2024-9438MEDIUMSEUR Oficial <= 2.2.11 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6052MEDIUMXSS in SQL check parametersEPSS 0.4%CVE-2024-54001MEDIUMKanboard allows a persistent HTML injection site scripting in settings page date formatEPSS 0.4%CVE-2024-11479MEDIUMAuthenticated HTML Injection in Issuetrak Ticket Comment FunctionEPSS 0.4%CVE-2024-47765MEDIUMMinecraft MOTD Parser's HtmlGenerator vulnerable to XSSEPSS 0.4%CVE-2026-59855HIGHSiYuan: Store XSS To Rce via Asset.renderEPSS 0.4%CVE-2025-54117CRITICALNamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editorEPSS 0.4%CVE-2024-23841HIGHXSS in @apollo/experimental-nextjs-app-supportEPSS 0.4%CVE-2024-24812MEDIUMFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesEPSS 0.4%CVE-2023-30615MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-webEPSS 0.4%CVE-2023-1384MEDIUMThe setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to bEPSS 0.4%CVE-2024-11404MEDIUMFile Upload Bypass in django FilerEPSS 0.4%CVE-2023-32192HIGHRancher API Server Cross-site Scripting VulnerabilityEPSS 0.4%CVE-2025-8029HIGHjavascript: URLs executed on object and embed tagsEPSS 0.4%CVE-2024-10038MEDIUMWP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5851MEDIUMplaySMS SMS Schedule cross site scriptingEPSS 0.4%CVE-2023-48763MEDIUMWordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerabilityEPSS 0.4%CVE-2025-47600MEDIUMWordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.4%CVE-2024-6251MEDIUMplaySMS New Phonebook cross site scriptingEPSS 0.4%