Cyber Resilience

CWE · MITRE source

CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Abstraction: Variant · CVEs in our corpus: 564

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Last updated: 11 August 2026 10:53 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 1 framework(s): CAPEC 3 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
  • SI-10 Information Input Validation
  • SA-8 Security and Privacy Engineering Principles
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.3.1
  • V1.3.3
  • V1.3.4

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-36094 8.78.90.64102022-09-08
CVE-2024-39363 8.79.60.48092025-01-14
CVE-2022-36096 8.68.90.59472022-09-08
CVE-2022-36097 8.68.90.57392022-09-08
CVE-2018-19943 KEV 8.38.00.17712020-10-28
CVE-2024-4439 7.97.20.70822024-05-03
CVE-2020-13965 KEV 7.56.10.76602020-06-09
CVE-2018-19953 KEV 7.56.10.23892020-10-28
CVE-2020-13562 7.26.10.77742021-02-01
CVE-2020-13563 7.26.10.75862021-02-01
CVE-2020-13564 7.26.10.75862021-02-01
CVE-2025-4278 7.18.70.08302025-06-12
CVE-2019-13923 7.09.60.01122019-09-13
CVE-2022-21145 7.04.80.77782022-04-14
CVE-2023-39216 7.09.60.01232023-08-08
CVE-2025-30676 7.06.10.65352025-04-01
CVE-2022-29168 6.99.60.00802022-06-25
CVE-2023-44393 6.99.30.01282023-10-09
CVE-2024-34070 6.99.60.00972024-05-14
CVE-2024-32484 6.97.40.25922024-07-22
CVE-2025-664816.89.60.00562025-12-09
CVE-2024-41947 6.79.00.01672024-07-31
CVE-2025-21612 6.68.60.00512025-01-06
CVE-2020-2503 6.59.00.00782020-12-24
CVE-2023-35153 6.59.00.00742023-06-23