CWE-83: Improper Neutralization of Script in Attributes in a Web Page
The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
27 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-58746 — Volkov Labs Business Links plugin vulnerable to privilege escalation attack
- CVE-2026-23516 — CVAT vulnerable to XSS via skeleton SVG images
- CVE-2026-45118 — MyBB: Contact page reflected XSS
- CVE-2024-52595 — HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
- CVE-2026-22849 — Saleor lacks proper HTML sanitization in rich text fields
- CVE-2025-11682 — Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform
- CVE-2025-4615 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
- CVE-2026-45733 — Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
- CVE-2026-49276 — Kirby: Self cross-site scripting (self-XSS) in the writer field
- CVE-2024-9103 — Persistent XSS in blocked messages
- CVE-2026-58263 — Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
- CVE-2025-0125 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
- CVE-2026-8245 — Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection
- CVE-2026-62324 — Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
- CVE-2026-45669 — Nuxt: Reflected XSS in `navigateTo()` external redirect
- CVE-2026-53722 — Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- CVE-2026-15920 — Potential cross-site scripting via URLField values in the admin
- CVE-2026-48591 — Stored XSS via unescaped HTML attribute values in earmark
- CVE-2025-27145 — copyparty renders unsanitized filenames as HTML when user uploads empty files
- CVE-2025-0137 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
Recently published
- CVE-2026-45118 — MyBB: Contact page reflected XSS
- CVE-2026-45733 — Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
- CVE-2026-15920 — Potential cross-site scripting via URLField values in the admin
- CVE-2026-62324 — Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
- CVE-2026-59727 — Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
- CVE-2026-49276 — Kirby: Self cross-site scripting (self-XSS) in the writer field
- CVE-2026-58263 — Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
- CVE-2026-48591 — Stored XSS via unescaped HTML attribute values in earmark
- CVE-2026-53841 — OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML
- CVE-2026-53722 — Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- CVE-2026-45669 — Nuxt: Reflected XSS in `navigateTo()` external redirect
- CVE-2026-8245 — Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection
- CVE-2026-23516 — CVAT vulnerable to XSS via skeleton SVG images
- CVE-2026-22849 — Saleor lacks proper HTML sanitization in rich text fields
- CVE-2025-11682 — Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform
- CVE-2025-4615 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
- CVE-2025-58746 — Volkov Labs Business Links plugin vulnerable to privilege escalation attack
- CVE-2025-0137 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
- CVE-2025-0125 — PAN-OS: Improper Neutralization of Input in the Management Web Interface
- CVE-2024-9103 — Persistent XSS in blocked messages
More specific weaknesses
- CWE-82 — Improper Neutralization of Script in Attributes of IMG Tags in a Web Page