CWE-692: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
9 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-52305 — UnoPim Stored XSS : Cookie hijacking through Create User function
- CVE-2025-20240 — A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attack
- CVE-2026-71478 — league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
- CVE-2024-42214 — HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method
- CVE-2026-15295 — Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-23569 — HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
- CVE-2025-49590 — CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
- CVE-2025-53904 — The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability
Recently published
- CVE-2026-71478 — league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
- CVE-2024-23569 — HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
- CVE-2024-42214 — HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method
- CVE-2026-15295 — Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2025-20240 — A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attack
- CVE-2025-53904 — The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability
- CVE-2025-49590 — CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
- CVE-2024-52305 — UnoPim Stored XSS : Cookie hijacking through Create User function