CWE-87— Improper Neutralization of Alternate XSS Syntax
The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.— MITRE CWE catalog
62 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-87page 2 of 2
- CVE-2025-27793MEDIUMCVSS 5.3EG 5.32025-03-27
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-li…
- CVE-2024-43381MEDIUMCVSS 5.0EG 5.02024-08-16
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS …
- CVE-2026-85293MEDIUMCVSS 4.8EG 4.82026-09-25
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values without enforcing email syntax and renders them unescaped inside double-qu…
- CVE-2026-55661MEDIUMCVSS 4.8EG 4.82026-06-18
Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing …
- CVE-2025-65961MEDIUMCVSS 4.8EG 4.82025-11-25
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has …
- CVE-2025-48992MEDIUMCVSS 4.8EG 4.82025-06-16
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious…
- CVE-2023-20208MEDIUMCVSS 4.8EG 4.82023-11-21
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device.
- CVE-2023-20188MEDIUMCVSS 4.8EG 4.82023-06-28
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authen…
- CVE-2024-25640MEDIUMCVSS 4.6EG 4.62024-02-19
Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions …
- CVE-2024-2657MEDIUMCVSS 4.4EG 4.42024-05-30
The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenti…
- CVE-2023-6446MEDIUMCVSS 4.4EG 4.42024-01-11
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible…
- CVE-2020-5298MEDIUMCVSS 4.0EG 4.02020-06-03
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload…
Map vulnerabilities like CWE-87 to your infrastructure
EchelonGraph correlates every CVE — across CWE-87 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →