Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-23522MEDIUMWordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-47612LOWXSS in Special:DataDump when displaying dump statusEPSS 0.3%CVE-2022-23543MEDIUMHTML attributes when attaching a YouTube link to the postEPSS 0.3%CVE-2026-34033MEDIUMApache Answer: HTML Content Injection in EmailEPSS 0.3%CVE-2024-54223MEDIUMWordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerabilityEPSS 0.3%CVE-2026-22469MEDIUMWordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.3%CVE-2026-12812MEDIUMRadware Cyber Controller HTML Report Generation HTML injectionEPSS 0.3%CVE-2025-64637MEDIUMWordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-8029HIGHjavascript: URLs executed on object and embed tagsEPSS 0.3%CVE-2024-35680MEDIUMWordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-35224HIGHStored Cross-Site Scripting (XSS) in OpenProjectEPSS 0.3%CVE-2026-6002HIGHHTML Injection in DivvyDrive Information Technologies' DivvyDriveEPSS 0.3%CVE-2026-32732NONEXSS in @leanprover/unicode-input-componentEPSS 0.3%CVE-2025-71331MEDIUMFlowise - Cross-Site Scripting in Chat Messages and Agent WorkflowsEPSS 0.3%CVE-2025-11241MEDIUMYoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-40873HIGHmailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenamesEPSS 0.3%CVE-2024-22277MEDIUMVMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud DirectoEPSS 0.3%CVE-2023-29112LOWCode Injection vulnerability in SAP Application Interface Framework (Message Monitoring)EPSS 0.3%CVE-2023-29110LOWCode Injection vulnerability in SAP Application Interface Framework (Message Dashboard)EPSS 0.3%