CWE-87: Improper Neutralization of Alternate XSS Syntax
The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template9.7 Critical
- cisco identity services engine, identity services engine software +1 moreA vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE)...5.4 Medium
- eng knowage, knowagelabs knowage-server +1 moreImproper Neutralization of Alternate XSS Syntax in Knowage-Server6.1 Medium
- jhy jsoup, netapp management services for element software, management services for netapp hci +1 more +3 morejsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled6.1 Medium
- cisco common services platform collector, common services platform collector software +1 moreCisco Common Services Platform Collector Stored Cross-Site Scripting Vulnerability5.5 Medium
- jupyter jupyterlabJupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>7.4 High
- octobercms octoberReflected XSS when importing CSV in OctoberCMS4.0 Medium
- apache tilesApache Tiles Vulnerable to XSS via EL Expression Injection6.8 Medium