Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-31062MEDIUMCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via tEPSS 0.8%CVE-2020-26067MEDIUMCisco Webex Teams Web Interface Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2024-10592MEDIUMMapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2021-1351MEDIUMCisco Webex Meetings Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2023-34354LOWA stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A EPSS 0.8%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2019-10933—A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate UserEPSS 0.8%CVE-2020-2503CRITICALStored cross-site scripting vulnerability in QESEPSS 0.8%CVE-2020-7579—A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) EPSS 0.8%CVE-2017-20026MEDIUMHumHub Reflected cross site scritingEPSS 0.8%CVE-2006-0149MEDIUMCross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary webEPSS 0.8%CVE-2018-19951—If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP SystemEPSS 0.8%CVE-2020-2493—Cross-site Scripting Vulnerability in Multimedia ConsoleEPSS 0.8%CVE-2017-20058MEDIUMElefant CMS Version Comparison Persistent cross site scritingEPSS 0.8%CVE-2025-54057MEDIUMApache SkyWalking: Stored XSS vulnerabilityEPSS 0.8%CVE-2022-39240MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraphEPSS 0.8%CVE-2022-20740MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2017-20033MEDIUMPHPList Reflected cross site scritingEPSS 0.7%CVE-2018-19942—Cross-site Scripting Vulnerability in File StationEPSS 0.7%CVE-2023-35153CRITICALXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersEPSS 0.7%