CWE-692: Incomplete Denylist to Cross-Site Scripting
Filter
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.
What the weakness is: CWE-692 at MITRE. All weaknesses
Related attack patterns (CAPEC): 5
- CAPEC-71 Using Unicode Encoding to Bypass Validation Logic Likelihood: Medium · Severity: High
- CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
- CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
- CAPEC-120 Double Encoding Likelihood: Low · Severity: Medium
- CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-692, as MITRE names them. Credits.
Ask an AI about CWE-692
Show the prompt
Explain CWE-692: Incomplete Denylist to Cross-Site Scripting and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/692.html and https://cve.bz/cve/cwe/692?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.4CVE-2026-107396EPSS 0.2%
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted …
- 6.1CVE-2026-71478EPSS 0.4%
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return,…
- 5.3CVE-2024-42214EPSS 0.3%
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the Web server which allows an attacker to narrow and intensify th…
- 4.3CVE-2024-23569EPSS 0.3%
HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
- 4.4CVE-2026-15295EPSS 0.2%
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. Thi…
- 6.1CVE-2025-20240EPSS 0.4%
A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to impr…
- 1.3CVE-2025-53904EPSS 0.4%
The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publica…
- 2.9CVE-2025-49590EPSS 0.3%
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that…
- 4.8CVE-2024-52305EPSS 0.2%
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. …
- 4.6CVE-2024-30924EPSS 0.3%
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
- 6.1CVE-2023-26047EPSS 0.5%
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with sp…