Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-71310LOWThe GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malEPSS 0.3%CVE-2025-62936MEDIUMWordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerabilityEPSS 0.3%CVE-2023-38007MEDIUMIBM Cloud Pak System HTML injectionEPSS 0.3%CVE-2024-51472LOWIBM DevOps Deploy / IBM UrbanCode Deploy HTML injectionEPSS 0.3%CVE-2025-0272MEDIUMHCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerabilityEPSS 0.3%CVE-2025-15058MEDIUMResponsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'EPSS 0.3%CVE-2026-25935HIGHVikunja Affected by XSS Via Task PreviewEPSS 0.3%CVE-2025-2895MEDIUMIBM Cloud Pak System HTML injectionEPSS 0.3%CVE-2025-65924MEDIUMERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.EPSS 0.3%CVE-2026-22422MEDIUMWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2026-27116MEDIUMVikunja has Reflected HTML Injection via filter Parameter in Projects ModuleEPSS 0.3%CVE-2025-31384HIGHWordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9147MEDIUMHTML Injection in Bna Informatics' PosPratikEPSS 0.3%CVE-2024-2010HIGHReflected XSS in TE Informatics' V5 SoftwareEPSS 0.3%CVE-2025-49398MEDIUMWordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-39642MEDIUMWordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.3%CVE-2025-4367MEDIUMDownload Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard ShortcodeEPSS 0.3%CVE-2025-13180MEDIUMBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scriptingEPSS 0.3%CVE-2024-36395MEDIUMVerint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.3%CVE-2025-13178MEDIUMBdtask/CodeCanyon SalesERP User Profile edit_profile cross site scriptingEPSS 0.3%