Cyber Posture

CWE · MITRE source

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Abstraction: Base · CVEs in our corpus: 43,879

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

There are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (3)AI

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIValidates web inputs to reject script-related content that could produce XSS.
SI-15Information Output FilteringSIOutput validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.
CA-8Penetration TestingCAPenetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2019-3929 KEV9.69.80.94252019-04-30
CVE-2024-42009 KEV9.39.30.91412024-08-05
CVE-2023-34192 KEV9.19.00.88992023-07-06
CVE-2022-27926 KEV8.96.10.94132022-04-21
CVE-2023-37580 KEV8.96.10.93922023-07-31
CVE-2020-3580 KEV8.86.10.93242020-10-21
CVE-2019-9978 KEV8.56.10.88332019-03-24
CVE-2023-5631 KEV8.36.10.84432023-10-18
CVE-2018-6882 KEV8.06.10.79522018-03-27
CVE-2023-43770 KEV8.06.10.80392023-09-22
CVE-2020-13965 KEV7.56.10.71822020-06-09
CVE-2014-2120 KEV7.46.10.69842014-03-19
CVE-2019-18426 KEV7.38.20.61002020-01-21
CVE-2023-42207.28.10.93242023-11-28
CVE-2023-497857.29.10.90442024-03-12
CVE-2020-35730 KEV7.16.10.64812020-12-28
CVE-2024-37383 KEV7.16.10.64032024-06-07
CVE-2024-287417.08.80.87992024-04-06
CVE-2020-53986.97.50.90182020-01-17
CVE-2020-11023 KEV6.96.90.58212020-04-29
CVE-2021-317616.99.60.82322021-04-25
CVE-2019-104756.86.10.92442019-10-23
CVE-2020-20966.86.10.92672020-01-15
CVE-2020-94966.86.10.93762020-07-15
CVE-2023-24426.88.70.84362023-06-07