cve.bz

CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages

Filter

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

What the weakness is: CWE-86 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 3
  • CAPEC-73 User-Controlled Filename Likelihood: High · Severity: High
  • CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
  • CAPEC-247 XSS Using Invalid Characters Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-86, as MITRE names them. Credits.

Ask an AI about CWE-86

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/86.html and https://cve.bz/cve/cwe/86?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2026-71478EPSS 0.4%

    league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return,…

  2. 7.8CVE-2026-28417EPSS 1.4%

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` pr…

  3. 2.1CVE-2025-66606EPSS 0.3%

    A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper with web pages or execute malicious scripts. The affected products and versi…

  4. 5.4CVE-2025-20168EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This v…

  5. 5.4CVE-2025-20167EPSS 0.3%

    A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This v…

  6. 5.4CVE-2025-20166EPSS 0.4%

    A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This v…

  7. 6.5CVE-2024-10941EPSS 0.4%

    A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126.

  8. 7.8CVE-2024-21864EPSS 0.3%

    Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.

  9. 7.2CVE-2021-33158EPSS 0.2%

    Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.

  10. 5.5CVE-2023-22840EPSS 0.4%

    Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local access.

  11. 9.6CVE-2023-31126EPSS 0.8%

    `org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid…