Falhas do tipo CWE-87
57 resultadosNeutralização inadequada de sintaxe alternativa de XSS
A aplicação tenta filtrar XSS bloqueando tags e atributos HTML conhecidos, mas falha contra variações alternativas de sintaxe (como espaços, tabulações, quebras de linha, entidades HTML ou protocolos alternativos). Um atacante usa essas formas alternativas para injetar código JavaScript que o filtro não reconhece.
Exemplo
Um filtro bloqueia '<script>' mas aceita '<script\n>' ou '<img src=x onerror\t=alert(1)>' ou '<img src="java	script:alert(1)">'. Cada variação contorna regras simplistas de sanitização.
Como mitigar
Use uma biblioteca consolidada de sanitização (DOMPurify, OWASP ESAPI) que normaliza a entrada antes de validar, e prefira sempre listar explicitamente o que é permitido (whitelist) em vez de bloquear variações conhecidas (blacklist).
CVE-2024-8505MEDIUMWordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label ParameterEPSS 0.4%CVE-2026-79946MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.4%CVE-2025-14732MEDIUMElementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIEPSS 0.3%CVE-2024-4459MEDIUMThemesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TitlesEPSS 0.3%CVE-2024-25640MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-webEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2024-3519MEDIUMMedia Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langEPSS 0.3%CVE-2024-2618MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2750MEDIUMExclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.3%CVE-2024-3162MEDIUMJeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via TestimonialEPSS 0.3%CVE-2026-42458MEDIUMMagento LTS: Reflected XSS - Import -> Data Flow (profiles)EPSS 0.3%CVE-2023-6446MEDIUMCalculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-50712MEDIUMImproper Neutralization of Alternate XSS Syntax in iris-web EPSS 0.3%CVE-2025-49137HIGHHax CMS Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2025-62415MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)EPSS 0.3%CVE-2025-62418MEDIUMbagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)EPSS 0.3%CVE-2025-62414MEDIUMbagisto - Cross Site Scripting (XSS) in Create New CustomerEPSS 0.3%CVE-2026-22711MEDIUMStored XSS through system messages in WikiLoveEPSS 0.3%CVE-2026-27120MEDIUMLeaf-kit html escaping does not work on characters that are part of extended grapheme clusterEPSS 0.3%