Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-34398MEDIUMAn issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers.EPSS 0.3%CVE-2025-14186MEDIUMGrandstream GXP1625 Network Status api.values.post cross site scriptingEPSS 0.3%CVE-2025-61583MEDIUMTS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handlingEPSS 0.3%CVE-2026-7380MEDIUMHTML Injection in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2025-52897MEDIUMGLPI is vulnerable to XSS and open redirection attacks through planning featureEPSS 0.3%CVE-2026-27458HIGHLinkAce: Stored XSS in Atom Feed via CDATA Escape in List DescriptionEPSS 0.3%CVE-2026-24564MEDIUMWordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerabilityEPSS 0.3%CVE-2025-32027MEDIUMYii does not prevent XSS in scenarios where fallback error renderer is usedEPSS 0.3%CVE-2026-105829MEDIUMLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml BypassEPSS 0.3%CVE-2025-66486MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.3%CVE-2025-55291HIGHShaarli allows reflected XSS via searchtags parameterEPSS 0.2%CVE-2026-42030MEDIUMMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerEPSS 0.2%CVE-2025-11265MEDIUMVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11267MEDIUMVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-39629MEDIUMWordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-39625MEDIUMWordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-4168MEDIUMSubpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.2%CVE-2026-63216MEDIUMZammad: Stored XSS via unescaped option labels in the object attribute options context UIEPSS 0.2%CVE-2025-22501HIGHWordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%