Falhas do tipo CWE-87

57 resultados

Neutralização inadequada de sintaxe alternativa de XSS

A aplicação tenta filtrar XSS bloqueando tags e atributos HTML conhecidos, mas falha contra variações alternativas de sintaxe (como espaços, tabulações, quebras de linha, entidades HTML ou protocolos alternativos). Um atacante usa essas formas alternativas para injetar código JavaScript que o filtro não reconhece.

Exemplo

Um filtro bloqueia '<script>' mas aceita '<script\n>' ou '<img src=x onerror\t=alert(1)>' ou '<img src="java&#x09;script:alert(1)">'. Cada variação contorna regras simplistas de sanitização.

Como mitigar

Use uma biblioteca consolidada de sanitização (DOMPurify, OWASP ESAPI) que normaliza a entrada antes de validar, e prefira sempre listar explicitamente o que é permitido (whitelist) em vez de bloquear variações conhecidas (blacklist).

CVE-2024-3666MEDIUMOpal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-48992MEDIUMGroup-Office vulnerable to blind XSSEPSS 0.3%CVE-2024-2657MEDIUMFont Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-33510HIGHDOM-Based XSS in Homarr /auth/login RedirectEPSS 0.2%CVE-2025-8561MEDIUMOva Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-55291HIGHShaarli allows reflected XSS via searchtags parameterEPSS 0.2%CVE-2026-46492HIGHmd-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)EPSS 0.2%CVE-2026-55237HIGHAutoGPT SignUp Page has DOM-Based XSS and Open RedirectEPSS 0.2%CVE-2026-85293MEDIUMInvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsEPSS 0.2%CVE-2026-34598HIGHYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"EPSS 0.2%CVE-2026-45314HIGHOpen WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/imageEPSS 0.2%CVE-2025-52563MEDIUMChamilo: Reflected XSS via page parameterEPSS 0.2%CVE-2025-65961LOWContao is vulnerable to cross-site scripting in templatesEPSS 0.2%CVE-2025-48076MEDIUMGalette is vulnerable to Cross-site ScriptingEPSS 0.2%CVE-2025-48494MEDIUMGokapi vulnerable to stored XSS via uploading file with malicious file nameEPSS 0.2%CVE-2026-35534HIGHChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionEPSS 0.2%CVE-2025-48495MEDIUMGokapi has stored XSS vulnerability in friendly name for API keysEPSS 0.1%