Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-40872CRITICALmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address fieldEPSS 0.3%CVE-2025-62418MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)EPSS 0.3%CVE-2025-62415MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)EPSS 0.3%CVE-2024-7629MEDIUMResponsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-73220HIGHCVAT: Stored XSS via annotation guides in audio tasksEPSS 0.3%CVE-2024-20504MEDIUMCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting VulnerabilitiesEPSS 0.3%CVE-2026-68919HIGHGoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesEPSS 0.3%CVE-2025-1997MEDIUMIBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injectionEPSS 0.3%CVE-2026-32822MEDIUMdataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public PagesEPSS 0.3%CVE-2026-44264MEDIUMWeblate is vulnerable to XSS via crafted MarkdownEPSS 0.3%CVE-2026-20047MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-14835HIGHWP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-53883CRITICALspacewalk-java has various XSS issues on search pageEPSS 0.3%CVE-2025-62796MEDIUMPrivateBin persistent HTML injection in attachment filename enables redirect and defacementEPSS 0.3%CVE-2022-38055MEDIUMWordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerabilityEPSS 0.3%CVE-2025-10125MEDIUMMemberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-49377MEDIUMJinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrintEPSS 0.3%CVE-2025-45286MEDIUMA cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafEPSS 0.3%CVE-2025-69169MEDIUMWordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerabilityEPSS 0.3%CVE-2024-51689HIGHWordPress CF7 WOW Styler plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%