Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2023-51308MEDIUMPHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, EPSS 0.4%CVE-2024-13704HIGHSuper Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-48910MEDIUMApache JSPWiki: Markdown parser allows XSS injection in Markdown error processingEPSS 0.3%CVE-2024-38469MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.EPSS 0.3%CVE-2024-28417MEDIUMWebedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.EPSS 0.3%CVE-2024-32790MEDIUMWordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-24673MEDIUMWordPress Ketchup Shortcodes Plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30210HIGHBruno XSS On Environment NameEPSS 0.3%CVE-2025-23392MEDIUMReflected XSS in SystemsController.java in spacewalk-javaEPSS 0.3%CVE-2025-24678MEDIUMWordPress Listamester Plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10621MEDIUMSimple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-2380MEDIUMXSS in graph renderingEPSS 0.3%CVE-2024-54128MEDIUMDirectus has an HTML Injection in CommentEPSS 0.3%CVE-2024-28831MEDIUMXSS in confirmation pop-upEPSS 0.3%CVE-2023-36555LOWAn improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to exeEPSS 0.3%CVE-2025-23393MEDIUMReflected XSS in spacewalk-javaEPSS 0.3%CVE-2024-47782HIGHCross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscoverEPSS 0.3%CVE-2024-28832MEDIUMXSS in Crash Report PageEPSS 0.3%CVE-2023-45635MEDIUMWordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerabilityEPSS 0.3%CVE-2024-23522MEDIUMWordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerabilityEPSS 0.3%