CWE-79Base13 in KEV

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable in the CWE catalog · 24,491 CVEs mapped

24,491
CVEs mapped
13
In KEV
6.3
Median CVSS
What it is

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Recent examples
3.5cvss
CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

LOWno explanation yet
—
epss
4.6cvss
CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

MEDIUMno explanation yet
—
epss
5.4cvss
CVE-2026-86483

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

MEDIUMno explanation yet
—
epss
The record
Technical detail
CWE ID
CWE-79
Abstraction
Base
Structure
Simple
Status
Stable
References (18)
https://en.wikipedia.org/wiki/Cross-site_scriptinghttps://www.microsoftpressstore.com/store/writing-secure-code-9780735617223http://ha.ckers.org/xss.htmlhttps://learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDNhttps://learn.microsoft.com/en-us/archive/blogs/cisg/anti-xss-3-0-beta-and-cat-net-community-technology-preview-now-livehttps://owasp.org/www-project-enterprise-security-api/https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/xss-defense-howto/http://www.owasp.org/index.php/Web_Application_Firewallhttp://projects.webappsec.org/w/page/13246985/Web%20Application%20Firewall%20Evaluation%20Criteriahttps://bugzilla.mozilla.org/show_bug.cgi?id=380418http://wicket.apache.org/http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheethttp://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheethttps://www.sans.org/blog/top-25-series-rank-1-cross-site-scripting/https://en.wikipedia.org/wiki/Samy_(computer_worm)http://www.omg.org/spec/ASCSM/1.0/https://d3fend.mitre.org/dao/artifact/d3f:ApplicationLayerFirewall/https://d3fend.mitre.org/technique/d3f:TrustedLibrary/