Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-49343MEDIUMIBM Informix Dynamic Server HTML injectionEPSS 0.2%CVE-2025-15345MEDIUMMapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' ParameterEPSS 0.2%CVE-2025-58054LOWDiscourse is vulnerable to XSS when quoting chat messagesEPSS 0.2%CVE-2025-29431LOWCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, EPSS 0.2%CVE-2025-13505MEDIUMStored XSS in Datateam's DatactiveEPSS 0.2%CVE-2025-11874MEDIUMSlippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-25054HIGHn8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UIEPSS 0.2%CVE-2026-39626MEDIUMWordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-36230MEDIUMXSS in IBM Aspera FaspexEPSS 0.2%CVE-2026-1834MEDIUMIbtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-33110MEDIUMIBM OpenPages Vulnerable to HTML InjectionEPSS 0.2%CVE-2025-11992MEDIUMMulti Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-28132MEDIUMWordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-36397MEDIUMSecurity vulnerabilities have been found in IBM Application GatewayEPSS 0.2%CVE-2025-10128MEDIUMEulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22402LOWDell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page EPSS 0.2%CVE-2026-35460MEDIUMPapra has an HTML Injection in Transactional Emails via Unescaped User Display NameEPSS 0.2%CVE-2025-52564MEDIUMChamilo: HTML injection via open parameterEPSS 0.2%CVE-2026-11511MEDIUMBolt CMS HTML Attribute TextType.php HTML injectionEPSS 0.2%