CWE-87 Improper Neutralization of Alternate XSS Syntax
variantThe product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (65)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-32797US | critical9.6 | — | ||
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In… | ||||
| CVE-2026-42235US | critical9.6 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a c… | ||||
| CVE-2026-33510US | high8.8 | — | ||
Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improper… | ||||
| CVE-2009-1275US | medium6.8 | — | ||
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attac… | ||||
| CVE-2017-7830US | medium6.5 | — | ||
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. Thi… | ||||
| CVE-2023-35161US | medium6.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript… | ||||
| CVE-2023-35160US | medium6.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript… | ||||
| CVE-2023-35159US | medium6.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript… | ||||
| CVE-2023-35158US | medium6.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript… | ||||
| CVE-2023-35156US | medium6.1 | — | ||
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript… | ||||
| CVE-2022-36033US | medium6.1 | — | ||
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expr… | ||||
| CVE-2019-0798US | medium6.1 | — | ||
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vu… | ||||
| CVE-2026-46492US | medium6.1 | — | ||
md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rend… | ||||
| CVE-2026-45314US | medium6.1 | — | ||
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profile_… | ||||
| CVE-2026-34598US | medium6.1 | — | ||
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript wit… | ||||
| CVE-2025-52563US | medium6.1 | — | ||
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parame… | ||||
| CVE-2025-49137US | medium6.1 | — | ||
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the… | ||||
| CVE-2022-39295US | medium6.1 | — | ||
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4… | ||||
| CVE-2025-48076US | medium5.4 | — | ||
Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue… | ||||
| CVE-2025-48495US | medium5.4 | — | ||
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS int… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan