Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-13505MEDIUMStored XSS in Datateam's DatactiveEPSS 0.2%CVE-2025-31604MEDIUMWordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66450HIGHLibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image UploadEPSS 0.2%CVE-2025-11874MEDIUMSlippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14792MEDIUMKey Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_renderEPSS 0.2%CVE-2026-25054HIGHn8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UIEPSS 0.2%CVE-2025-33110MEDIUMIBM OpenPages Vulnerable to HTML InjectionEPSS 0.2%CVE-2025-11992MEDIUMMulti Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-29426MEDIUMCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cyEPSS 0.2%CVE-2025-58054LOWDiscourse is vulnerable to XSS when quoting chat messagesEPSS 0.2%CVE-2025-29431LOWCode-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, EPSS 0.2%CVE-2026-39626MEDIUMWordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2026-108925MEDIUMCohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)EPSS 0.2%CVE-2025-15345MEDIUMMapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' ParameterEPSS 0.2%CVE-2025-59540MEDIUMChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise FeedbackEPSS 0.2%CVE-2025-54698MEDIUMWordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection VulnerabilityEPSS 0.2%CVE-2026-1834MEDIUMIbtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-103443LOWAPI permits session-seeded javascript URL XSSEPSS 0.2%CVE-2026-123840MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%