Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-26282HIGHUsing an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affEPSS 0.3%CVE-2024-47612LOWXSS in Special:DataDump when displaying dump statusEPSS 0.3%CVE-2026-34033MEDIUMApache Answer: HTML Content Injection in EmailEPSS 0.3%CVE-2025-52902HIGHFile Browser has Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-11241MEDIUMYoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-57440HIGHMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledEPSS 0.3%CVE-2024-54223MEDIUMWordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerabilityEPSS 0.3%CVE-2026-12812MEDIUMRadware Cyber Controller HTML Report Generation HTML injectionEPSS 0.3%CVE-2026-54570MEDIUMAngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point BypassEPSS 0.3%CVE-2025-64637MEDIUMWordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-35680MEDIUMWordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-35224HIGHStored Cross-Site Scripting (XSS) in OpenProjectEPSS 0.3%CVE-2026-6002HIGHHTML Injection in DivvyDrive Information Technologies' DivvyDriveEPSS 0.3%CVE-2025-71331MEDIUMFlowise - Cross-Site Scripting in Chat Messages and Agent WorkflowsEPSS 0.3%CVE-2025-54789MEDIUMFiles is Vulnerable to Reflected Self-XSS through its File Move FunctionalityEPSS 0.3%CVE-2024-22277MEDIUMVMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud DirectoEPSS 0.3%CVE-2026-123469MEDIUMWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityEPSS 0.3%CVE-2023-29110LOWCode Injection vulnerability in SAP Application Interface Framework (Message Dashboard)EPSS 0.3%CVE-2023-29112LOWCode Injection vulnerability in SAP Application Interface Framework (Message Monitoring)EPSS 0.3%CVE-2026-120852MEDIUMWordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerabilityEPSS 0.3%