Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2026-116858MEDIUMWordPress Forminator plugin <= 1.58.3 - Content Injection vulnerabilityEPSS 0.2%CVE-2025-8386HIGHAVEVA Application Server IDE Basic Cross-site ScriptingEPSS 0.2%CVE-2026-39712MEDIUMWordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.2%CVE-2025-64187MEDIUMOctoPrint is vulnerable to XSS through Action Command Notifications and PromptsEPSS 0.2%CVE-2021-47948MEDIUMWordPress GetPaid Plugin 2.4.6 HTML Injection via Help TextEPSS 0.2%CVE-2023-3481MEDIUMXSS in Chrome Lab CrittersEPSS 0.2%CVE-2026-106159MEDIUMCross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQueryEPSS 0.2%CVE-2026-106157MEDIUMCross-Site Scripting via PanelBar Item URLs in Kendo UI for jQueryEPSS 0.2%CVE-2026-106158MEDIUMCross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQueryEPSS 0.2%CVE-2026-44259MEDIUMefw4.X: Stored XSS via previewServletEPSS 0.2%CVE-2026-45346MEDIUMOpen WebUI: Stored Cross-Site Scripting in SVG RendererEPSS 0.2%CVE-2026-39841MEDIUMStored XSS through list fields on Cargo's page values and Special:CargoTablesEPSS 0.2%CVE-2026-26460MEDIUMA HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplieEPSS 0.2%CVE-2026-29106MEDIUMSuiteCRM has blind XSS in return_id parameterEPSS 0.2%CVE-2026-9646MEDIUMScadaBR Unauthenticated Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-89290LOWHTML Injection in İzometri Informatics' eimzamipEPSS 0.2%CVE-2026-34718MEDIUMZammad improperly neutralizes of script-related HTML tags in ticket articlesEPSS 0.2%CVE-2026-0396LOWHTML injection in the web dashboardEPSS 0.1%CVE-2026-106162MEDIUMCross-Site Scripting in FileManager Drag Hints in Kendo UI for jQueryEPSS 0.1%CVE-2025-58430HIGHlistmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverEPSS 0.1%