Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-22469MEDIUMWordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2024-13497HIGHWordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-26482HIGHAn HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of EPSS 0.3%CVE-2026-32732NONEXSS in @leanprover/unicode-input-componentEPSS 0.3%CVE-2025-57928MEDIUMWordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerabilityEPSS 0.3%CVE-2019-18944MEDIUMMicro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.EPSS 0.3%CVE-2026-119479MEDIUMWordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-103437LOWReadingLists imported metadata permits JavaScript URL XSSEPSS 0.3%CVE-2024-35112MEDIUMIBM Control Center cross-site scriptingEPSS 0.3%CVE-2026-119507MEDIUMWordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-64225MEDIUMWordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-33080HIGHFilament: Unvalidated Range and Values summarizer values can be used for XSSEPSS 0.3%CVE-2023-48285MEDIUMWordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerabilityEPSS 0.3%CVE-2023-35006MEDIUMIBM Security ReaQta HTML injectionEPSS 0.3%CVE-2025-0277MEDIUMHCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)EPSS 0.3%CVE-2025-0276MEDIUMHCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)EPSS 0.3%CVE-2026-20070MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-3521MEDIUMTeam Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-47869MEDIUMWordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerabilityEPSS 0.3%CVE-2026-103585LOWattacker-controlled javascript license URL via XSSEPSS 0.3%