Falhas do tipo CWE-83

30 resultados

Falha em neutralizar URIs perigosas em atributos de evento HTML

A aplicação não remove ou filtra corretamente URIs do tipo 'javascript:' e similares em atributos de evento (onmouseover, onload, onerror, onclick, etc.) e atributos de estilo. Isso permite que um atacante injete código JavaScript que será executado no navegador da vítima quando o evento disparar.

Exemplo

Um sistema de comentários aceita HTML e tenta sanitizar removendo apenas tags <script>. Um atacante consegue injetar <img src=x onerror='javascript:alert(1)'> ou <div style='background:url(javascript:void(0))'>. Quando o comentário é exibido, o navegador executa o código JavaScript sem restrições.

Como mitigar

Use uma biblioteca de sanitização robusta (como DOMPurify no front-end ou OWASP Java HTML Sanitizer no back-end) que remova completamente atributos de evento perigosos e URIs javascript:. Implemente também Content Security Policy (CSP) no servidor para bloquear inline scripts como camada adicional de proteção.

CVE-2023-37908CRITICALorg.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityEPSS 1.1%CVE-2025-4615MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.8%CVE-2022-39262MEDIUMStored Cross-Site Scripting (XSS) on login page in GLPIEPSS 0.7%CVE-2023-32070CRITICALImproper Neutralization of Script in Attributes in XWiki (X)HTML renderersEPSS 0.7%CVE-2026-45118CRITICALMyBB: Contact page reflected XSSEPSS 0.5%CVE-2026-59727LOWAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsEPSS 0.5%CVE-2024-52595HIGHHTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughEPSS 0.5%CVE-2020-14525LOWPhilips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PageEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2026-49276HIGHKirby: Self cross-site scripting (self-XSS) in the writer fieldEPSS 0.4%CVE-2025-0125MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.4%CVE-2025-0137MEDIUMPAN-OS: Improper Neutralization of Input in the Management Web InterfaceEPSS 0.4%CVE-2023-30958MEDIUMDOM XSS in Developer mode dashboard via redirect GET parameterEPSS 0.4%CVE-2026-91127HIGHFile Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererEPSS 0.4%CVE-2026-15920MEDIUMPotential cross-site scripting via URLField values in the adminEPSS 0.4%CVE-2026-53722MEDIUMNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLEPSS 0.3%CVE-2026-62324MEDIUMJodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSEPSS 0.3%CVE-2025-58746CRITICALVolkov Labs Business Links plugin vulnerable to privilege escalation attackEPSS 0.3%CVE-2026-58263HIGHJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierEPSS 0.3%