Cyber Posture

CWE · MITRE source

CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Abstraction: Variant · CVEs in our corpus: 519

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-13965 KEV7.56.10.71822020-06-09
CVE-2024-44396.97.20.90822024-05-03
CVE-2020-135625.56.10.70982021-02-01
CVE-2024-418105.36.10.67842024-07-29
CVE-2018-19953 KEV5.16.10.31522020-10-28
CVE-2022-360965.18.90.54512022-09-08
CVE-2022-360974.48.90.44192022-09-08
CVE-2022-360944.18.90.38852022-09-08
CVE-2018-19943 KEV4.08.00.07032020-10-28
CVE-2024-105923.86.40.41442024-11-16
CVE-2020-135633.66.10.39512021-02-01
CVE-2020-135643.66.10.39512021-02-01
CVE-2024-419472.69.00.13012024-07-31
CVE-2024-393632.69.60.10652025-01-14
CVE-2020-260672.35.40.21082024-11-18
CVE-2023-443932.29.30.06242023-10-09
CVE-2024-377322.16.10.13952024-06-24
CVE-2022-291682.09.60.00642022-06-25
CVE-2023-295082.08.90.04442023-04-16
CVE-2024-340702.09.60.00972024-05-14
CVE-2019-139231.99.60.00422019-09-13
CVE-2023-351531.99.00.02352023-06-23
CVE-2023-392161.99.60.00442023-08-08
CVE-2024-523001.99.00.00882024-11-13
CVE-2025-538351.99.00.01742025-07-14