Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-31575MEDIUMWordPress Flag Icons plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-20232MEDIUMCisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-41693MEDIUMMashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.3%CVE-2024-41697MEDIUMPriority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.3%CVE-2026-50146HIGHAstro: Reflected XSS via unescaped slot nameEPSS 0.3%CVE-2024-38318MEDIUMIBM Aspera Shares HTML injectionEPSS 0.3%CVE-2025-58970MEDIUMWordPress Doctreat theme <= 1.6.7 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-29427MEDIUMCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first aEPSS 0.3%CVE-2025-45286MEDIUMA cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafEPSS 0.3%CVE-2025-24680HIGHWordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-44369HIGHCVAT: Stored XSS via annotation guidesEPSS 0.3%CVE-2026-123860MEDIUMWordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-121777MEDIUMWordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-119496MEDIUMWordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerabilityEPSS 0.3%CVE-2024-49337MEDIUMIBM OpenPages HTML injectionEPSS 0.3%CVE-2026-25467MEDIUMWordPress User Registration plugin <= 5.3.0 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-123183MEDIUMWordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-20331MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabiliyEPSS 0.3%CVE-2026-102279LOWLaravel: XSS in Debug Page InformationEPSS 0.3%CVE-2025-69169MEDIUMWordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerabilityEPSS 0.3%