Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2018-19951—If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP SystemEPSS 0.8%CVE-2017-20058MEDIUMElefant CMS Version Comparison Persistent cross site scritingEPSS 0.8%CVE-2017-20033MEDIUMPHPList Reflected cross site scritingEPSS 0.8%CVE-2022-20740MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2018-25034LOWThomson TCW710 wlanPrimaryNetwork Persistent cross site scriptingEPSS 0.7%CVE-2023-35153CRITICALXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parametersEPSS 0.7%CVE-2026-75872MEDIUMHTML Injection in MailerUp double opt-in verification emailEPSS 0.7%CVE-2019-6585—A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCAEPSS 0.7%CVE-2017-20089LOWGwolle Guestbook Plugin cross site scritingEPSS 0.7%CVE-2017-20087LOWAlpine PhotoTile for Instagram Plugin cross site scritingEPSS 0.7%CVE-2023-42458LOWZope vulnerable to Stored Cross Site Scripting with SVG imagesEPSS 0.7%CVE-2017-20100LOWAir Transfer cross site scriptingEPSS 0.7%CVE-2021-29438MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsEPSS 0.7%CVE-2022-1274—A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to KeycEPSS 0.7%CVE-2018-16555—A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All EPSS 0.7%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.7%CVE-2023-22464MEDIUMViewVC XSS vulnerability in revision view changed path "copyfrom" locationsEPSS 0.7%CVE-2023-33197MEDIUMCraft CMS stored XSS in indexedVolumesEPSS 0.7%CVE-2023-5933MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabEPSS 0.7%CVE-2026-52816MEDIUMGogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSEPSS 0.7%