Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-27514MEDIUMGLPI is susceptible to Stored XSS attack through project's kanbanEPSS 0.2%CVE-2026-39837MEDIUMStored XSS through the dynamic table format in CargoEPSS 0.2%CVE-2026-5389MEDIUMjusthtml before 1.13.0 XSS via code fence breakoutEPSS 0.2%CVE-2026-27166MEDIUMDiscourse vulnerable to HTML injection via prohibited iframe URLsEPSS 0.2%CVE-2026-1564MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%CVE-2025-6247MEDIUMWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-54698MEDIUMWordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection VulnerabilityEPSS 0.2%CVE-2026-2995HIGHImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2026-27578HIGHn8n Vulnerable to Stored XSS via Various NodesEPSS 0.2%CVE-2026-40875HIGHmailcow: dockerized vulnerable to stored XSS in user login history real_ripEPSS 0.2%CVE-2026-41575MEDIUMth30d4y/IP: DOM-Based Cross-Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-39839MEDIUMStored XSS through URLs in Cargo's map formatEPSS 0.2%CVE-2025-48884MEDIUMGalette is vulnerable to XSS through Document TypeEPSS 0.2%CVE-2025-27358MEDIUMWordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-39425MEDIUMMaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown RenderingEPSS 0.2%CVE-2026-44839MEDIUMRabbitMQ: Unsanitized vhost names allow for XSS in management UIEPSS 0.2%CVE-2025-52654MEDIUMHCL MyXalytics is affected by an HTML InjectionEPSS 0.2%CVE-2025-59540MEDIUMChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackEPSS 0.2%CVE-2026-33657MEDIUMEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post fieldEPSS 0.2%CVE-2025-31992MEDIUMHCL MaxAI Assistant is susceptible to a HTML injection vulnerabilityEPSS 0.2%