Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-10125MEDIUMMemberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-7629MEDIUMResponsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-5218MEDIUMHTML Injection in Softtr's E-Commerce PackEPSS 0.3%CVE-2025-32230MEDIUMWordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerabilityEPSS 0.3%CVE-2026-119473MEDIUMWordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-41752MEDIUMIBM Cognos Analytics HTML injectionEPSS 0.3%CVE-2026-12751MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.EPSS 0.3%CVE-2026-44264MEDIUMWeblate is vulnerable to XSS via crafted MarkdownEPSS 0.3%CVE-2026-32822MEDIUMdataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public PagesEPSS 0.3%CVE-2026-25006MEDIUMWordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2025-33138MEDIUMIBM Aspera Faspex HTML injectionEPSS 0.3%CVE-2024-51475MEDIUMIBM Content Navigator HTML injectionEPSS 0.3%CVE-2026-39941MEDIUMChurchCRM has an XSS vulnerabilityEPSS 0.3%CVE-2026-25764LOWOpenProject vulnerable to Stored HTML injectionEPSS 0.3%CVE-2022-38055MEDIUMWordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerabilityEPSS 0.3%CVE-2025-54346HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.EPSS 0.3%CVE-2025-12803MEDIUMBold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs ShortcodeEPSS 0.3%CVE-2025-20267MEDIUMCisco Identity Services Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-20047MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-39628MEDIUMWordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%