Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-50229MEDIUMApache Tomcat: XSS in number guess exampleEPSS 4.1%CVE-2020-4047MEDIUMAuthenticated XSS via media attachment page in WordPressEPSS 3.3%CVE-2020-4049LOWAuthenticated self-XSS via theme uploads in WordPressEPSS 2.5%CVE-2014-2353—Cogent DataHub XSSEPSS 2.5%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2020-4046MEDIUMAuthenticated XSS through embed block in WordPressEPSS 2.1%CVE-2020-26218HIGHHTML Injection in touchbase.aiEPSS 1.9%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.7%CVE-2024-41947CRITICALXWiki Platform XSS through conflict resolutionEPSS 1.7%CVE-2023-39217MEDIUMImproper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.EPSS 1.6%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.6%CVE-2022-21238MEDIUMA cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HEPSS 1.5%CVE-2020-5267MEDIUMPossible XSS vulnerability in ActionViewEPSS 1.5%CVE-2016-9493—PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingEPSS 1.5%CVE-2021-32718LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIEPSS 1.4%CVE-2021-32719LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginEPSS 1.4%CVE-2022-28648MEDIUMIn JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedEPSS 1.4%CVE-2020-5283LOWXSS vulnerability in CVS show_subdir_lastmod supportEPSS 1.4%CVE-2022-29251HIGHCross-site Scripting in the Flamingo theme managerEPSS 1.3%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%