CWE-81 Improper Neutralization of Script in an Error Message Web Page
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-81 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vp62-88p7-qqf5 | CVE-2026-41568 | MODERATE |
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap |
2026-06-12 | |
| GHSA-j8hp-f2mj-586g | CVE-2024-47882 | MODERATE |
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project |
2024-10-24 | |
| GHSA-3p62-6fjh-3p5h | CVE-2022-4361 | CRITICAL |
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC |
2023-07-07 | |
| GHSA-jqj4-r483-4gvr | - | MODERATE |
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 |
2021-10-08 | |
| GHSA-rp4x-wxqv-cf9m | CVE-2019-25027 | MODERATE |
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 |
2021-04-16 |