Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2020-26067MEDIUMCisco Webex Teams Web Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-2502—Cross-site Scripting Vulnerability in Photo StationEPSS 0.8%CVE-2024-31062MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.8%CVE-2024-10592MEDIUMMapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2023-34354LOWA stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A EPSS 0.8%CVE-2021-1351MEDIUMCisco Webex Meetings Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2020-12811MEDIUMA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unaEPSS 0.8%CVE-2025-55672MEDIUMApache Superset: Stored XSS on charts metadataEPSS 0.8%CVE-2026-73237MEDIUMApache Allura: XSS in markdown pipelineEPSS 0.8%CVE-2026-73238MEDIUMApache Allura: XSS in code displayEPSS 0.8%CVE-2025-54057MEDIUMApache SkyWalking: Stored XSS vulnerabilityEPSS 0.8%CVE-2019-10933—A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate UserEPSS 0.8%CVE-2020-2503CRITICALStored cross-site scripting vulnerability in QESEPSS 0.8%CVE-2020-7579—A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) EPSS 0.8%CVE-2017-20026MEDIUMHumHub Reflected cross site scritingEPSS 0.8%CVE-2018-19942—Cross-site Scripting Vulnerability in File StationEPSS 0.8%CVE-2006-0149MEDIUMCross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary webEPSS 0.8%CVE-2022-39240MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraphEPSS 0.8%CVE-2018-19951—If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP SystemEPSS 0.8%