CWE-81 Improper Neutralization of Script in an Error Message Web Page
variantThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (11)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-4137US | medium6.1 | Exploit | ||
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbi… | ||||
| CVE-2022-4361US | medium6.1 | Exploit | ||
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attac… | ||||
| CVE-2024-47882US | medium6.1 | — | ||
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and excep… | ||||
| CVE-2024-47064US | medium6.1 | — | ||
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a malicio… | ||||
| CVE-2024-6892US | medium6.1 | — | ||
Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application. | ||||
| CVE-2019-25027US | medium6.1 | — | ||
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaa… | ||||
| CVE-2026-41568US | — | — | ||
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a rac… | ||||
| CVE-2025-24344US | — | — | ||
A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute… | ||||
| CVE-2025-0883US | — | — | ||
Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager.
The vulnerability could reveal sensitive information retained by the br… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan