Common Weakness Enumeration
CWE-692 Incomplete Denylist to Cross-Site Scripting
Description
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-692 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-c4wc-ggrj-jg9v | CVE-2026-107396 | MODERATE |
Indico: Cross-Site-Scripting in link fields |
2026-10-08 | |
| GHSA-29pj-957v-52mc | CVE-2026-71478 | MODERATE | - |
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes |
2026-08-06 |
| GHSA-cgr4-c233-h733 | CVE-2024-52305 | MODERATE | - |
UnoPim Stored XSS : Cookie hijacking through Create User function |
2024-11-13 |
| GHSA-p2pf-g8cq-3gq5 | CVE-2023-26047 | MODERATE |
teler-waf contains detection rule bypass via Entities payload |
2024-05-20 |