CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page
variantThe web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (27)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-96654US | —OT critical | KEV | ||
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own p… | ||||
| CVE-2026-25141US | critical9.8 | — | ||
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incompl… | ||||
| CVE-2023-25729US | high8.8OT elevated | — | ||
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <cod… | ||||
| CVE-2022-40181US | high8.3 | — | ||
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126… | ||||
| CVE-2022-20764US | high8.1 | — | ||
Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of s… | ||||
| CVE-2026-88859US | medium6.3 | — | ||
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks o… | ||||
| CVE-2024-45045US | medium6.1 | — | ||
Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject J… | ||||
| CVE-2021-3824US | medium6.1 | — | ||
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. | ||||
| CVE-2020-7011US | medium6.1 | — | ||
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a resul… | ||||
| CVE-2023-30959US | medium5.4 | — | ||
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. | ||||
| CVE-2023-25571US | medium5.4 | — | ||
Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugi… | ||||
| CVE-2017-13828US | medium5.5 | — | ||
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Fonts" component. It allows remote attackers to spoof the user interfac… | ||||
| CVE-2025-30203US | medium4.8 | — | ||
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS wi… | ||||
| CVE-2026-67338US | — | — | ||
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can p… | ||||
| CVE-2026-16244US | — | — | ||
A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorder… | ||||
| CVE-2026-54443US | — | — | ||
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before render… | ||||
| CVE-2025-58444US | — | — | ||
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior… | ||||
| CVE-2024-52890US | — | — | ||
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs. | ||||
| CVE-2025-25329US | — | — | ||
An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link. | ||||
| CVE-2025-25334US | — | — | ||
An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan