目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-80 Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本) 类漏洞列表 413

CWE-80 Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本) 类弱点 413 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-80即基础型跨站脚本攻击，属于输入验证缺陷。攻击者通过注入包含恶意脚本的HTML标签，利用程序未正确转义特殊字符的漏洞，使浏览器执行非预期代码，从而窃取数据或劫持会话。开发者应严格对用户输入进行白名单过滤，并对输出至HTML页面的数据进行实体编码，确保特殊字符被正确转义，从而阻断脚本执行。

MITRE CWE 官方描述
CWE：CWE-80 Web 页面中脚本相关 HTML 标签的不当中和（基本型 XSS） 英文：产品从上游组件接收输入，但未对特殊字符（如 "<"、">" 和 "&"）进行中和或进行了不正确的中和，这些字符在发送给处理 Web 页面的下游组件时，可能被解释为 Web 脚本元素。
常见影响 (1)
Confidentiality, Integrity, AvailabilityRead Application Data, Execute Unauthorized Code or Commands
An attacker could insert special characters that are processed client-side in the context of the user's session.
缓解措施 (4)
ImplementationCarefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities i…
ImplementationUse and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are i…
ImplementationWith Struts, write all data from form beans with the bean's filter attribute set to true.
ImplementationTo help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is n…
Effectiveness: Defense in Depth
代码示例 (1)
In the following example, a guestbook comment isn't properly encoded, filtered, or otherwise neutralized for script-related tags before being displayed in a client browser.
<% for (Iterator i = guestbook.iterator(); i.hasNext(); ) { Entry e = (Entry) i.next(); %> <p>Entry #<%= e.getId() %></p> <p><%= e.getText() %></p> <% } %>
Bad · JSP
CVE ID标题CVSS风险等级Published
CVE-2026-9646 Sensorweb ScadaBR 安全漏洞 — ScadaBR 6.1 Medium2026-05-28
CVE-2026-44839 RabbitMQ 安全漏洞 — rabbitmq-server--2026-05-27
CVE-2026-39642 WordPress plugin Nyla 安全漏洞 — Nyla 5.3 Medium2026-05-26
CVE-2025-71310 Backdrop CMS 安全漏洞 — GDPR cookies module for Backdrop CMS--2026-05-26
CVE-2026-34246 CtrlPanel-gg 安全漏洞 — panel 4.8 Medium2026-05-19
CVE-2026-45346 Open WebUI 安全漏洞 — open-webui--2026-05-15
CVE-2025-15345 WordPress plugin MapGeo – Interactive Geo Maps 安全漏洞 — MapGeo – Interactive Geo Maps 6.1 Medium2026-05-14
CVE-2026-44369 CVAT.ai CVAT 安全漏洞 — cvat--2026-05-13
CVE-2026-44259 EFW Framework 安全漏洞 — efw4.X 4.6 Medium2026-05-12
CVE-2026-41611 Microsoft Visual Studio Code 命令注入漏洞 — Visual Studio Code 7.8 High2026-05-12
CVE-2021-47948 WordPress plugin GetPaid 安全漏洞 — Payments Plugin GetPaid 5.4 Medium2026-05-10
CVE-2026-42030 Mapserver 安全漏洞 — MapServer 6.1 Medium2026-05-08
CVE-2026-44264 Weblate 安全漏洞 — weblate 4.3 Medium2026-05-07
CVE-2026-6002 DivvyDrive 安全漏洞 — DivvyDrive 8.8 High2026-05-07
CVE-2025-59854 HCL DFXAnalytics 跨站脚本漏洞 — DFXAnalytics 3.1 Low2026-05-06
CVE-2026-1564 Pega Platform 安全漏洞 — Pega Infinity 5.5 -2026-04-15
CVE-2026-20170 Cisco Webex Contact Center 安全漏洞 — Cisco Webex Contact Center 6.1 Medium2026-04-15
CVE-2026-40105 XWiki Platform 安全漏洞 — xwiki-platform 8.8 -2026-04-15
CVE-2026-39425 MaxKB 安全漏洞 — MaxKB 5.4 -2026-04-14
CVE-2026-33657 EspoCRM 安全漏洞 — espocrm 4.6 Medium2026-04-13
CVE-2026-34718 Zammad 安全漏洞 — zammad 5.4AIMediumAI2026-04-08
CVE-2026-39712 WordPress plugin tagDiv Composer 安全漏洞 — tagDiv Composer 5.3 Medium2026-04-08
CVE-2026-39628 WordPress plugin DukaMarket 安全漏洞 — DukaMarket 5.3 Medium2026-04-08
CVE-2026-39629 WordPress plugin Uminex 安全漏洞 — Uminex 5.3 Medium2026-04-08
CVE-2026-39625 WordPress plugin TechOne 安全漏洞 — TechOne 5.3 Medium2026-04-08
CVE-2026-39626 WordPress plugin Armania 安全漏洞 — Armania 5.3 Medium2026-04-08
CVE-2026-39837 MediaWiki - Cargo Extension 安全漏洞 — Mediawiki - Cargo Extension 6.1AIMediumAI2026-04-07
CVE-2026-39841 MediaWiki - Cargo Extension 安全漏洞 — Mediawiki - Cargo Extension 6.1AIMediumAI2026-04-07
CVE-2026-39839 MediaWiki - Cargo Extension 安全漏洞 — Mediawiki - Cargo Extension 6.1AIMediumAI2026-04-07
CVE-2026-39344 ChurchCRM 安全漏洞 — CRM 6.1AIMediumAI2026-04-07

CWE-80（Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)） 是常见的弱点类别，本平台收录该类弱点关联的 413 条 CVE 漏洞。