CWE-83 Improper Neutralization of Script in Attributes in a Web Page
Description
The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-83 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-c42q-qvc3-j6vg | CVE-2026-108260 | HIGH |
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS |
2026-10-09 | |
| GHSA-3753-m2x2-q623 | CVE-2026-91127 | HIGH |
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer |
2026-09-18 | |
| GHSA-934w-87qh-qr26 | CVE-2026-53722 | MODERATE |
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL |
2026-08-14 | |
| GHSA-7pw4-f3q4-r2p2 | CVE-2026-59727 | LOW |
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands |
2026-08-12 | |
| GHSA-rxcw-mc6f-6hr3 | CVE-2026-58263 | HIGH |
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier |
2026-07-31 | |
| GHSA-j839-gqq4-gf9j | CVE-2026-62324 | MODERATE |
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS |
2026-07-31 | |
| GHSA-fx6j-w5w5-h468 | CVE-2026-45669 | MODERATE |
Nuxt: Reflected XSS in `navigateTo()` external redirect |
2026-07-08 | |
| GHSA-f73j-pm2c-rxvr | CVE-2026-8245 | MODERATE | - |
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination |
2026-06-24 |
| GHSA-6xcg-6q43-rj2v | - | LOW |
Duplicate Advisory: Exported session HTML could keep unsafe markdown links |
2026-06-18 | |
| GHSA-rhj6-r49h-5932 | CVE-2026-49276 | HIGH | - |
Kirby: Self cross-site scripting (self-XSS) in the writer field |
2026-06-18 |
| GHSA-52mm-h59v-f3c7 | CVE-2026-48591 | MODERATE | - |
earmark: Stored XSS via unescaped HTML attribute values |
2026-06-18 |
| GHSA-vf6r-87q4-2vjf | CVE-2024-34343 | MODERATE |
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR |
2025-05-15 | |
| GHSA-m2jw-cj8v-937r | CVE-2025-27145 | LOW |
copyparty renders unsanitized filenames as HTML when user uploads empty files |
2025-02-26 | |
| GHSA-5jfw-gq64-q45f | CVE-2024-52595 | HIGH |
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through |
2025-01-14 | |
| GHSA-663w-2xp3-5739 | CVE-2023-37908 | CRITICAL |
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability |
2023-11-01 | |
| GHSA-6gf5-c898-7rxp | CVE-2023-32070 | CRITICAL |
maven/org.xwiki.platform/xwiki-core-rendering-api
maven/org.xwiki.platform/xwiki-platform-annotation-core
maven/org.xwiki.rendering/xwiki-rendering-syntax-annotatedhtml5
maven/org.xwiki.rendering/xwiki-rendering-syntax-annotatedxhtml
maven/org.xwiki.rendering/xwiki-rendering-syntax-html
maven/org.xwiki.rendering/xwiki-rendering-syntax-html5
maven/org.xwiki.rendering/xwiki-rendering-syntax-xhtml
|
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers |
2023-05-11 |