cve.bz

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page, page 2

Filter

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

What the weakness is: CWE-80 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-18 XSS Targeting Non-Script Elements Likelihood: High · Severity: Very High
  • CAPEC-32 XSS Through HTTP Query Strings Likelihood: High · Severity: High
  • CAPEC-86 XSS Through HTTP Headers Likelihood: High · Severity: Very High
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-80, as MITRE names them. Credits.

Ask an AI about CWE-80

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/80.html and https://cve.bz/cve/cwe/80?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-55696EPSS 0.4%

    PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl…

  2. 4.3CVE-2026-5218EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: be…

  3. 5.1CVE-2026-5389EPSS 0.2%

    justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-…

  4. 4.6CVE-2026-35163EPSS 0.2%

    OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/oc…

  5. 8.5CVE-2026-73220EPSS 0.5%

    CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-…

  6. 5.4CVE-2026-20232EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interfac…

  7. 8.6CVE-2026-52854EPSS 0.6%

    Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays par…

  8. 6.9CVE-2026-54570EPSS 0.3%

    AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding …

  9. 6.9CVE-2026-75872EPSS 0.7%

    HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's…

  10. 2.1CVE-2026-75082EPSS 0.4%

    A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_na…

  11. 2.1CVE-2026-19988EPSS 0.4%

    A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The a…

  12. 6.1CVE-2026-73238EPSS 0.8%

    XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

  13. 6.1CVE-2026-73237EPSS 0.8%

    XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

  14. 5.3CVE-2026-65841EPSS 0.5%

    Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG …

  15. 4.8CVE-2026-34497EPSS 0.2%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.

  16. 6.5CVE-2026-48910EPSS 0.6%

    A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive i…

  17. 9.3CVE-2024-58355EPSS 0.4%

    Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTM…

  18. 9.3CVE-2024-58353EPSS 0.4%

    Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dange…

  19. 6.1CVE-2026-32822EPSS 0.3%

    dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthe…

  20. 5.9CVE-2026-54443EPSS 0.3%

    Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href att…

  21. 4.8CVE-2026-59838EPSS 0.2%

    A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions…

  22. 5.1CVE-2026-57167EPSS 0.5%

    PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash …

  23. 8.6CVE-2026-59855EPSS 0.4%

    SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a …

  24. 6.1CVE-2026-7380EPSS 0.3%

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Targeting HTML Attributes. This issue affects Access Control Sy…

  25. 5.7CVE-2025-36321EPSS 0.4%

    IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of t…

  26. 6.1CVE-2026-50229ExploitEPSS 4.1%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, f…

  27. 5.3CVE-2025-64637EPSS 0.3%

    Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

  28. 2.1CVE-2026-57535EPSS 0.4%

    Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and di…

  29. 2.1CVE-2026-57534EPSS 0.4%

    Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

  30. 2.1CVE-2026-57533EPSS 0.3%

    Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

  31. 8.8CVE-2026-57532EPSS 0.4%

    Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of a…

  32. 2.0CVE-2026-13314EPSS 0.4%

    Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

  33. 5.3CVE-2026-13225EPSS 0.4%

    Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

  34. 5.4CVE-2026-52816EPSS 0.7%

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scrip…

  35. 6.1CVE-2026-50146EPSS 0.3%

    Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attrib…

  36. 5.4CVE-2025-62198EPSS 0.5%

    An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue.

  37. 2.0CVE-2026-12812EPSS 0.3%

    A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The manipulation leads to HTML injection. Remote exploitation of the attack is poss…

  38. 5.1CVE-2025-71331EPSS 0.3%

    Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <i…

  39. 6.1CVE-2026-46492EPSS 0.2%

    md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendere…

  40. 5.4CVE-2026-34033EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escap…

  41. 2.0CVE-2026-11511EPSS 0.2%

    A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lea…

  42. 6.1CVE-2026-9646EPSS 0.2%

    A reflected cross-site scripting issue exists in URL handling.

  43. 5.6CVE-2026-44839EPSS 0.2%

    RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.

  44. 5.3CVE-2026-39642EPSS 0.3%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.

  45. 1.8CVE-2025-71310EPSS 0.3%

    The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This …

  46. 4.8CVE-2026-34246EPSS 0.2%

    CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role management interface. In app/Http/Controllers/Admin/RoleController…

  47. 5.1CVE-2026-45346EPSS 0.2%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6…

  48. 6.1CVE-2025-15345EPSS 0.2%

    The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to, and including, 1.6.27 due to insufficient input sanitization…

  49. 8.5CVE-2026-44369EPSS 0.3%

    CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then…

  50. 4.6CVE-2026-44259EPSS 0.2%

    efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg exte…