Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-22254NONEWinter Affected by Stored Cross-Site Scripting (XSS) in Asset ManagerEPSS 0.3%CVE-2026-39628MEDIUMWordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2025-20267MEDIUMCisco Identity Services Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-24680HIGHWordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31575MEDIUMWordPress Flag Icons plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2010HIGHReflected XSS in TE Informatics' V5 SoftwareEPSS 0.3%CVE-2025-33138MEDIUMIBM Aspera Faspex HTML injectionEPSS 0.3%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.3%CVE-2026-39642MEDIUMWordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2025-12803MEDIUMBold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs ShortcodeEPSS 0.3%CVE-2024-36395MEDIUMVerint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.3%CVE-2024-51472LOWIBM DevOps Deploy / IBM UrbanCode Deploy HTML injectionEPSS 0.3%CVE-2025-54346HIGHA Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.EPSS 0.3%CVE-2025-61583MEDIUMTS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handlingEPSS 0.3%CVE-2026-7380MEDIUMHTML Injection in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2025-0272MEDIUMHCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerabilityEPSS 0.3%CVE-2026-25764LOWOpenProject vulnerable to Stored HTML injectionEPSS 0.3%CVE-2025-31384HIGHWordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-34398MEDIUMAn issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers.EPSS 0.2%CVE-2025-4367MEDIUMDownload Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard ShortcodeEPSS 0.2%