CWE-85: Doubled Character XSS Manipulations
Filter
The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
What the weakness is: CWE-85 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-245 XSS Using Doubled Characters Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-85, as MITRE names them. Credits.
Ask an AI about CWE-85
Show the prompt
Explain CWE-85: Doubled Character XSS Manipulations and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/85.html and https://cve.bz/cve/cwe/85?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.4CVE-2024-13721EPSS 0.3%
The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This …
- 5.4CVE-2022-41676EPSS 0.5%
Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflect…