Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-58412MEDIUMA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thrEPSS 0.2%CVE-2021-47948MEDIUMWordPress GetPaid Plugin 2.4.6 HTML Injection via Help TextEPSS 0.2%CVE-2023-3481MEDIUMXSS in Chrome Lab CrittersEPSS 0.2%CVE-2025-54348MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2EPSS 0.2%CVE-2026-1282LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2025-14289MEDIUMIBM webMethods Integration Server is vulnerable to HTML injectionEPSS 0.2%CVE-2026-39712MEDIUMWordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-36121MEDIUMHTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages ApplicationEPSS 0.2%CVE-2026-45346MEDIUMOpen WebUI: Stored Cross-Site Scripting in SVG RendererEPSS 0.2%CVE-2026-5218MEDIUMHTML Injection in Softtr's E-Commerce PackEPSS 0.2%CVE-2026-32891CRITICALAnchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSSEPSS 0.2%CVE-2026-26460MEDIUMA HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplieEPSS 0.2%CVE-2025-64187MEDIUMOctoPrint is vulnerable to XSS through Action Command Notifications and PromptsEPSS 0.2%CVE-2026-9646MEDIUMScadaBR Unauthenticated Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-39841MEDIUMStored XSS through list fields on Cargo's page values and Special:CargoTablesEPSS 0.2%CVE-2025-8386HIGHAVEVA Application Server IDE Basic Cross-site ScriptingEPSS 0.2%CVE-2025-52563MEDIUMChamilo: Reflected XSS via page parameterEPSS 0.2%CVE-2026-34718MEDIUMZammad improperly neutralizes of script-related HTML tags in ticket articlesEPSS 0.1%CVE-2026-29106MEDIUMSuiteCRM has blind XSS in return_id parameterEPSS 0.1%CVE-2026-44259MEDIUMefw4.X: Stored XSS via previewServletEPSS 0.1%