CWE-83: Improper Neutralization of Script in Attributes in a Web Page
The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- gfi usa, llc kerioconnect GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter 5.1 Medium
- gfi usa, llc kerioconnect GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment 6.2 Medium
- schorschii oco-server OCO-Server: Stored XSS through agent hostnames in command buttons 7.4 High
- opnsense core OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout 5.4 Medium
- @tinacms web-components, tinacms +1 more @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS 7.6 High
- @file-viewer doc, flyfish-dev file-viewer, msdoc-viewer +2 more File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer 8.2 High
- mybb MyBB: Contact page reflected XSS 9.3 Critical
- triliumnext trilium Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app 8.3 High
- djangoproject django Potential cross-site scripting via URLField values in the admin 5.1 Medium
- xdan jodit Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS 5.4 Medium
- withastro astro Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands 2.1 Low
- xdan jodit Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier 7.2 High
- getkirby kirby Kirby: Self cross-site scripting (self-XSS) in the writer field 7.4 High
- pragdave earmark Stored XSS via unescaped HTML attribute values in earmark 4.8 Medium
- openclaw OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML 2.1 Low
- @clerk nuxt Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL 5.1 Medium
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection 6.0 Medium
- @clerk nuxt Nuxt: Reflected XSS in `navigateTo()` external redirect 5.3 Medium
- cvat-ai cvat, cvat computer vision annotation tool +1 more CVAT vulnerable to XSS via skeleton SVG images 8.6 High
- saleor Saleor lacks proper HTML sanitization in rich text fields 7.2 High
- simplemachines simple machines forum A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows... 6.1 Medium
- perx technologies customer engagement & loyalty platform Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform 7.1 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 more PAN-OS: Improper Neutralization of Input in the Management Web Interface 5.4 Medium
- volkovlabs business-links Volkov Labs Business Links plugin vulnerable to privilege escalation attack 9.1 Critical
- palo alto networks pan-os, cloud ngfw +1 more PAN-OS: Improper Neutralization of Input in the Management Web Interface 4.8 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 more PAN-OS: Improper Neutralization of Input in the Management Web Interface 6.9 Medium
- forcepoint email security Persistent XSS in blocked messages 6.1 Medium
- 9001 copyparty copyparty renders unsanitized filenames as HTML when user uploads empty files 3.6 Low
- fedora-python lxml html clean HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through 7.7 High
- @clerk nuxt Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt 6.3 Medium
- mozilla firefox, firefox for ios +1 more An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI... 7.8 High
- xwiki xwiki-rendering org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability 9.1 Critical
- zabbix frontend, palantir com.palantir.foundry:foundry-frontend +1 more DOM XSS in Developer mode dashboard via redirect GET parameter 4.7 Medium
- xwiki rendering, xwiki, xwiki xwiki-rendering +2 more Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers 9.1 Critical
- glpi-project glpi Stored Cross-Site Scripting (XSS) on login page in GLPI 5.2 Medium
- philips clinical collaboration platform Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web Page 3.5 Low