Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2023-47513MEDIUMWordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerabilityEPSS 0.4%CVE-2022-23543MEDIUMHTML attributes when attaching a YouTube link to the postEPSS 0.4%CVE-2024-45406MEDIUMCraft CMS stored XSS in breadcrumb list and title fieldsEPSS 0.4%CVE-2023-51308MEDIUMPHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, EPSS 0.4%CVE-2026-17143MEDIUMMultiple Vulnerabilities in IBM API ConnectEPSS 0.4%CVE-2024-13704HIGHSuper Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-28417MEDIUMWebedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.EPSS 0.3%CVE-2024-38469MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.EPSS 0.3%CVE-2024-32790MEDIUMWordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-10621MEDIUMSimple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-2380MEDIUMXSS in graph renderingEPSS 0.3%CVE-2024-54128MEDIUMDirectus has an HTML Injection in CommentEPSS 0.3%CVE-2023-45053MEDIUMWordPress WP Content Pilot plugin <= 1.3.3 - HTML Injection vulnerabilityEPSS 0.3%CVE-2024-28831MEDIUMXSS in confirmation pop-upEPSS 0.3%CVE-2024-47782HIGHCross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscoverEPSS 0.3%CVE-2024-20460MEDIUMCisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-25578MEDIUMNavidrome is vulnerable to XSS via comment from song metadataEPSS 0.3%CVE-2024-28832MEDIUMXSS in Crash Report PageEPSS 0.3%CVE-2026-103444LOWStored XSS through system messages in WikiForumEPSS 0.3%CVE-2024-26282HIGHUsing an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affEPSS 0.3%