Improper Neutralization of Encoded URI Schemes in a Web Page
CWE-84
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
We track 3 vulnerabilities of this type. 67% are rated high or critical, and the average CVSS score is 7.8. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Resolve all URIs to absolute or canonical representations before processing.
- Implementation: With Struts, write all data from form beans with the bean's filter attribute set to true.
Latest Improper Neutralization of Encoded URI Schemes in a Web Page vulnerabilities
- 6.5 Medium severity
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Exploited
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- 8.6 High severity
inspector: Improper Neutralization of Encoded URI Schemes in a Web Page
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redi
- 8.3 High severity
Desigo PXM30-1: Improper Neutralization of Input During Web Page Generation
A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All v