Falhas do tipo CWE-80

632 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2017-20057MEDIUMElefant CMS Persistent cross site scritingEPSS 0.6%CVE-2018-25037LOWThomson TCW710 RgDdns Persistent cross site scritingEPSS 0.6%CVE-2017-20094LOWNewStatPress Plugin Persistent cross site scritingEPSS 0.6%CVE-2023-46722MEDIUMPimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewsEPSS 0.6%CVE-2026-52773MEDIUMReflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWikiEPSS 0.6%CVE-2020-36544LOWSialWeb CMS Search cross site scritingEPSS 0.6%CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2022-20765MEDIUMCisco UCS Director JavaScript Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-32489MEDIUMTCPDF before 6.7.4 mishandles calls that use HTML syntax.EPSS 0.6%CVE-2020-36196—Stored XSS Vulnerability in QuLog CenterEPSS 0.6%CVE-2024-47139MEDIUMF5 BIG-IQ VulnerabilityEPSS 0.6%CVE-2025-66481CRITICALDeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentEPSS 0.6%CVE-2026-52854HIGHmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser functionEPSS 0.6%CVE-2017-20044MEDIUMNavetti PricePoint Reflected cross site scritingEPSS 0.6%CVE-2017-20043MEDIUMNavetti PricePoint Persistent cross site scritingEPSS 0.6%CVE-2024-25639MEDIUMPrompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clientsEPSS 0.6%CVE-2023-24497MEDIUMCross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-EPSS 0.6%CVE-2023-24496MEDIUMCross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-EPSS 0.6%CVE-2024-46910HIGHApache Atlas: An authenticated user can perform XSS and potentially impersonate another userEPSS 0.6%CVE-2025-54414MEDIUMAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttonsEPSS 0.6%