Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-50229MEDIUMApache Tomcat: XSS in number guess exampleEPSS 4.1%CVE-2020-4047MEDIUMAuthenticated XSS via media attachment page in WordPressEPSS 3.3%CVE-2020-4049LOWAuthenticated self-XSS via theme uploads in WordPressEPSS 2.5%CVE-2014-2353—Cogent DataHub XSSEPSS 2.5%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2020-4046MEDIUMAuthenticated XSS through embed block in WordPressEPSS 2.1%CVE-2016-9493—PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingEPSS 2.0%CVE-2020-26218HIGHHTML Injection in touchbase.aiEPSS 1.9%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.7%CVE-2024-41947CRITICALXWiki Platform XSS through conflict resolutionEPSS 1.7%CVE-2023-39217MEDIUMImproper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.EPSS 1.6%CVE-2020-5267MEDIUMPossible XSS vulnerability in ActionViewEPSS 1.5%CVE-2019-1010018—Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users bEPSS 1.5%CVE-2022-21238MEDIUMA cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HEPSS 1.4%CVE-2021-32718LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIEPSS 1.4%CVE-2021-32719LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginEPSS 1.4%CVE-2022-28648MEDIUMIn JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedEPSS 1.4%CVE-2018-4848—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT sEPSS 1.3%CVE-2022-29251HIGHCross-site Scripting in the Flamingo theme managerEPSS 1.3%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%