Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-6247MEDIUMWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-52563MEDIUMChamilo: Reflected XSS via page parameterEPSS 0.2%CVE-2025-58412MEDIUMA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thrEPSS 0.2%CVE-2025-52654MEDIUMHCL MyXalytics is affected by an HTML InjectionEPSS 0.2%CVE-2026-41575MEDIUMth30d4y/IP: DOM-Based Cross-Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54348MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2EPSS 0.2%CVE-2026-106163MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowserEPSS 0.2%CVE-2026-39425MEDIUMMaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown RenderingEPSS 0.2%CVE-2026-44839MEDIUMRabbitMQ: Unsanitized vhost names allow for XSS in management UIEPSS 0.2%CVE-2026-106147MEDIUMCross-Site Scripting via ListBox Bound Text in Kendo UI for jQueryEPSS 0.2%CVE-2026-106151MEDIUMCross-Site Scripting in Validator Validation Messages in Kendo UI for jQueryEPSS 0.2%CVE-2026-106148MEDIUMCross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQueryEPSS 0.2%CVE-2025-31992MEDIUMHCL MaxAI Assistant is susceptible to a HTML injection vulnerabilityEPSS 0.2%CVE-2026-106161MEDIUMCross-Site Scripting via Badge Text Binding in Kendo UI for jQueryEPSS 0.2%CVE-2026-106149MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery MenuEPSS 0.2%CVE-2026-4418MEDIUMIBM Cloud Pak System HTML InjectionEPSS 0.2%CVE-2025-36121MEDIUMHTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages ApplicationEPSS 0.2%CVE-2026-33657MEDIUMEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post fieldEPSS 0.2%CVE-2026-32891CRITICALAnchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSSEPSS 0.2%CVE-2026-42694MEDIUMWordPress Kirki plugin <= 6.4.0 - Content Injection vulnerabilityEPSS 0.2%