CWE-83: Improper Neutralization of Script in Attributes in a Web Page
Filter
The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
What the weakness is: CWE-83 at MITRE. OWASP Top 10: A05:2025 Injection
Related attack patterns (CAPEC): 3
- CAPEC-243 XSS Targeting HTML Attributes Severity: Medium
- CAPEC-244 XSS Targeting URI Placeholders Likelihood: High · Severity: High
- CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-83, as MITRE names them. Credits.
Ask an AI about CWE-83
Show the prompt
Explain CWE-83: Improper Neutralization of Script in Attributes in a Web Page and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/83.html and https://cve.bz/cve/cwe/83?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.1CVE-2026-112356EPSS 0.2%
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authe…
- 6.2CVE-2026-112353EPSS 0.2%
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a…
- 7.4CVE-2026-61791EPSS 0.3%
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored…
- 5.4CVE-2026-58391EPSS 0.3%
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without q…
- 7.6CVE-2026-108260EPSS 0.3%
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL schem…
- 8.2CVE-2026-91127EPSS 0.4%
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyp…
- 9.3CVE-2026-45118EPSS 0.5%
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirec…
- 8.3CVE-2026-45733EPSS 0.4%
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute e…
- 5.1CVE-2026-15920EPSS 0.4%
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe …
- 5.4CVE-2026-62324EPSS 0.3%
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case v…
- 2.1CVE-2026-59727EPSS 0.4%
Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied t…
- 7.4CVE-2026-49276EPSS 0.4%
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, makin…
- 7.2CVE-2026-58263EPSS 0.2%
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's e…
- 4.8CVE-2026-48591EPSS 0.1%
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex sp…
- 2.1CVE-2026-53841EPSS 0.2%
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens…
- 5.1CVE-2026-53722EPSS 0.3%
Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underl…
- 5.3CVE-2026-45669EPSS 0.2%
Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv=…
- 6.0CVE-2026-8245EPSS 0.1%
Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" ……
- 8.6CVE-2026-23516EPSS 0.2%
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able t…
- 7.2CVE-2026-22849EPSS 0.2%
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malici…
- 6.1CVE-2025-67163EPSS 0.3%
A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.
- 7.1CVE-2025-11682EPSS 0.2%
Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due t…
- 5.5CVE-2025-4615EPSS 0.8%
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security ri…
- 9.0CVE-2025-58746EPSS 0.3%
The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate t…
- 4.8CVE-2025-0137EPSS 0.4%
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS adm…
- 6.9CVE-2025-0125EPSS 0.4%
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS adm…
- 6.1CVE-2024-9103EPSS 0.2%
Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.
- 6.1CVE-2025-27145EPSS 0.5%
copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging…
- 6.1CVE-2024-52595EPSS 0.5%
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<…
- 7.8CVE-2024-26283EPSS 0.3%
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
- 9.6CVE-2023-37908EPSS 1.1%
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML co…
- 6.1CVE-2023-30958EPSS 0.4%
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.
- 6.1CVE-2023-32070EPSS 0.7%
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in …
- 4.8CVE-2022-39262EPSS 0.8%
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains maliciou…
- 3.5CVE-2020-14525EPSS 0.5%
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a webpage that is served to other users.