Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-35460MEDIUMPapra has an HTML Injection in Transactional Emails via Unescaped User Display NameEPSS 0.2%CVE-2026-35163MEDIUMOctoPrint: XSS in Suppressed Command NotificationsEPSS 0.2%CVE-2025-36230MEDIUMXSS in IBM Aspera FaspexEPSS 0.2%CVE-2026-27166MEDIUMDiscourse vulnerable to HTML injection via prohibited iframe URLsEPSS 0.2%CVE-2026-1282LOWImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2025-36397MEDIUMSecurity vulnerabilities have been found in IBM Application GatewayEPSS 0.2%CVE-2025-10128MEDIUMEulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-39837MEDIUMStored XSS through the dynamic table format in CargoEPSS 0.2%CVE-2026-39733MEDIUMWordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-76563MEDIUMHTML Injection in FileorbisEPSS 0.2%CVE-2026-123469MEDIUMWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityEPSS 0.2%CVE-2026-123483MEDIUMWordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-48884MEDIUMGalette is vulnerable to XSS through Document TypeEPSS 0.2%CVE-2025-22402LOWDell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page EPSS 0.2%CVE-2025-14289MEDIUMIBM webMethods Integration Server is vulnerable to HTML injectionEPSS 0.2%CVE-2026-10511MEDIUMJupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' ParameterEPSS 0.2%CVE-2026-11511MEDIUMBolt CMS HTML Attribute TextType.php HTML injectionEPSS 0.2%CVE-2026-2995HIGHImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.2%CVE-2026-39839MEDIUMStored XSS through URLs in Cargo's map formatEPSS 0.2%CVE-2026-1564MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%