Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-1807MEDIUMEastnets PaymentSafe Edit Manual Reply directRouter.rfc cross site scriptingEPSS 0.4%CVE-2025-23392MEDIUMReflected XSS in SystemsController.java in spacewalk-javaEPSS 0.4%CVE-2024-4214LOWWordPress cardealer plugin <= 4.15 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-32966MEDIUMStored Cross-site Scripting in directory listings via file names in static-web-serverEPSS 0.4%CVE-2024-52967LOWAn improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attackeEPSS 0.4%CVE-2026-55696MEDIUMPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionEPSS 0.4%CVE-2025-23393MEDIUMReflected XSS in spacewalk-javaEPSS 0.4%CVE-2024-12127MEDIUMLearning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page ParameterEPSS 0.4%CVE-2026-40872CRITICALmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address fieldEPSS 0.4%CVE-2023-46235MEDIUMFOG stored XSS on log screen via unsanitized request loggingEPSS 0.4%CVE-2025-24673MEDIUMWordPress Ketchup Shortcodes Plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24678MEDIUMWordPress Listamester Plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-43790MEDIUMiTop vulnerable to XSS in friendlyname in object detailsEPSS 0.4%CVE-2025-39524MEDIUMWordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2023-49852MEDIUMWordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerabilityEPSS 0.4%CVE-2025-30210HIGHBruno XSS On Environment NameEPSS 0.4%CVE-2023-20257MEDIUMA vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conductEPSS 0.4%CVE-2023-1013MEDIUMXSS in Vira-InvestingEPSS 0.4%CVE-2021-44196MEDIUMXSS in UBIT Information Technologies Student Information Management SystemEPSS 0.4%CVE-2021-44197MEDIUMXSS in UBIT Information Technologies Student Information Management SystemEPSS 0.4%