CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
Filter
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
What the weakness is: CWE-84 at MITRE. All weaknesses
Ask an AI about CWE-84
Show the prompt
Explain CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/84.html and https://cve.bz/cve/cwe/84?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-96654KEVEPSS 1.9%
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- 6.3CVE-2026-88859EPSS 0.5%
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler inco…
- 5.1CVE-2026-67338EPSS 0.3%
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in pro…
- 5.9CVE-2026-54443EPSS 0.3%
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href att…
- 8.6CVE-2025-58444EPSS 0.7%
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers …
- 6.1CVE-2024-52890EPSS 0.2%
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.
- 4.8CVE-2025-30203EPSS 0.3%
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over…
- 5.5CVE-2025-25329EPSS 0.2%
An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25334EPSS 0.2%
An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25331EPSS 0.2%
An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25330EPSS 0.2%
An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25326EPSS 0.2%
An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25325EPSS 0.2%
An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25324EPSS 0.2%
An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.
- 5.5CVE-2025-25323EPSS 0.2%
An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.
- 2.5CVE-2024-42184EPSS 0.1%
BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.
- 6.1CVE-2024-45045EPSS 0.3%
Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in docu…
- 5.4CVE-2023-30959EPSS 0.4%
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
- 5.4CVE-2023-25571EPSS 0.5%
Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-s…
- 8.3CVE-2022-40181EPSS 1.0%
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), …
- 6.1CVE-2021-3824EPSS 0.7%
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
- 6.1CVE-2020-7011EPSS 1.0%
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an atta…