Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-42030MEDIUMMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerEPSS 0.2%CVE-2026-24564MEDIUMWordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-31326MEDIUMHTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.2%CVE-2026-25006MEDIUMWordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-52741HIGHGoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesEPSS 0.2%CVE-2025-62936MEDIUMWordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerabilityEPSS 0.2%CVE-2024-9147MEDIUMHTML Injection in Bna Informatics' PosPratikEPSS 0.2%CVE-2026-59838MEDIUMA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 tEPSS 0.2%CVE-2025-65924MEDIUMERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.EPSS 0.2%CVE-2025-66486MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-49398MEDIUMWordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-32027MEDIUMYii does not prevent XSS in scenarios where fallback error renderer is usedEPSS 0.2%CVE-2025-59573MEDIUMWordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection VulnerabilityEPSS 0.2%CVE-2026-23528MEDIUMDask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and DashboardEPSS 0.2%CVE-2023-38007MEDIUMIBM Cloud Pak System HTML injectionEPSS 0.2%CVE-2026-39625MEDIUMWordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-25935HIGHVikunja Affected by XSS Via Task PreviewEPSS 0.2%CVE-2026-39629MEDIUMWordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-2895MEDIUMIBM Cloud Pak System HTML injectionEPSS 0.2%CVE-2025-22501HIGHWordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%