CWE-80Variant2 in KEV

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Incomplete in the CWE catalog · 542 CVEs mapped

542
CVEs mapped
2
In KEV
5.5
Median CVSS
What it is

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Recent examples
6.1cvss
CVE-2026-32773

CVE-2026-32773 - MEDIUM Severity Vulnerability

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

MEDIUMno explanation yet
0%
epss
none
CVE-2026-82838

CVE-2026-82838 - UNKNOWN Severity Vulnerability

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

no explanation yet
0%
epss
4.3cvss
CVE-2026-55696

CVE-2026-55696 - MEDIUM Severity Vulnerability

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.

MEDIUMno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-80
Abstraction
Variant
Structure
Simple
Status
Incomplete