Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-82838MEDIUMDefault webserver configuration with incorrect CSPEPSS 0.2%CVE-2025-13180MEDIUMBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scriptingEPSS 0.2%CVE-2025-13178MEDIUMBdtask/CodeCanyon SalesERP User Profile edit_profile cross site scriptingEPSS 0.2%CVE-2025-22501HIGHWordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-55291HIGHShaarli allows reflected XSS via searchtags parameterEPSS 0.2%CVE-2025-14186MEDIUMGrandstream GXP1625 Network Status api.values.post cross site scriptingEPSS 0.2%CVE-2026-54503MEDIUMplone.app.textfield: Stored XSS by spoofing mime typeEPSS 0.2%CVE-2025-14735MEDIUMAmazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-46492HIGHmd-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)EPSS 0.2%CVE-2026-22422MEDIUMWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-4168MEDIUMSubpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11265MEDIUMVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11267MEDIUMVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-27155MEDIUMIn-memory stored Cross-site scripting (XSS) vulnerability in pineconesimEPSS 0.2%CVE-2026-27458HIGHLinkAce: Stored XSS in Atom Feed via CDATA Escape in List DescriptionEPSS 0.2%CVE-2025-20342MEDIUMCisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-25363MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) beEPSS 0.2%CVE-2025-20331MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabiliyEPSS 0.2%CVE-2026-55696MEDIUMPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionEPSS 0.2%CVE-2025-11987MEDIUMVisual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview ShortcodeEPSS 0.2%