Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-42195LOWHCL DevOps Deploy / HCL Launch is vulnerable to HTML injectionEPSS 0.3%CVE-2024-38039MEDIUMBUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.EPSS 0.3%CVE-2024-49377MEDIUMJinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrintEPSS 0.3%CVE-2025-1997MEDIUMIBM UrbanCode Deploy (UCD) / IBM DevOps Deploy HTML injectionEPSS 0.3%CVE-2025-28015MEDIUMA HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management SysEPSS 0.3%CVE-2025-29430MEDIUMCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and romEPSS 0.3%CVE-2024-51689HIGHWordPress CF7 WOW Styler plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-22254NONEWinter Affected by Stored Cross-Site Scripting (XSS) in Asset ManagerEPSS 0.3%CVE-2026-48202MEDIUMWordPress Brave plugin <= 0.8.8 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-103584LOWattacker-controlled javascript license URL via XSSEPSS 0.3%CVE-2024-5741MEDIUMXSS in inventory viewEPSS 0.3%CVE-2023-23735MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection VulnerabilityEPSS 0.3%CVE-2023-46310MEDIUMWordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-43938HIGHYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderEPSS 0.3%CVE-2025-63068MEDIUMWordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-64633MEDIUMWordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-28499MEDIUMLeafKit's HTML escaping may be skipped for Collection values, enabling XSSEPSS 0.3%CVE-2025-31326MEDIUMHTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.3%CVE-2025-62418MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)EPSS 0.3%CVE-2025-62414MEDIUMbagisto - Cross Site Scripting (XSS) in Create New CustomerEPSS 0.3%