CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Abstraction: Variant · CVEs in our corpus: 588

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Last updated: 25 September 2026 21:25 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SA-3 System Development Life Cycle
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.1
V1.3.1
V1.3.3
V1.3.4

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2022-36094`	8.8	8.9	0.6479	2022-09-08
`CVE-2024-39363`	8.7	9.6	0.4809	2025-01-14
`CVE-2022-36096`	8.6	8.9	0.6022	2022-09-08
`CVE-2022-36097`	8.6	8.9	0.5816	2022-09-08
`CVE-2018-19943` KEV	8.3	8.0	0.2148	2020-10-28
`CVE-2024-4439`	7.9	7.2	0.7102	2024-05-03
`CVE-2020-13965` KEV	7.5	6.1	0.7660	2020-06-09
`CVE-2018-19953` KEV	7.5	6.1	0.2877	2020-10-28
`CVE-2020-13562`	7.2	6.1	0.7774	2021-02-01
`CVE-2020-13563`	7.2	6.1	0.7586	2021-02-01
`CVE-2020-13564`	7.2	6.1	0.7586	2021-02-01
`CVE-2025-4278`	7.2	8.7	0.1063	2025-06-12
`CVE-2025-30676`	7.1	6.1	0.6761	2025-04-01
`CVE-2019-13923`	7.0	9.6	0.0112	2019-09-13
`CVE-2022-21145`	7.0	4.8	0.7778	2022-04-14
`CVE-2023-39216`	7.0	9.6	0.0123	2023-08-08
`CVE-2022-29168`	6.9	9.6	0.0084	2022-06-25
`CVE-2023-44393`	6.9	9.3	0.0128	2023-10-09
`CVE-2024-34070`	6.9	9.6	0.0097	2024-05-14
`CVE-2024-32484`	6.8	7.4	0.2231	2024-07-22
`CVE-2025-66481`	6.8	9.6	0.0058	2025-12-09
`CVE-2024-41947`	6.7	9.0	0.0167	2024-07-31
`CVE-2025-21612`	6.6	8.6	0.0051	2025-01-06
`CVE-2026-6002`	6.6	8.8	0.0045	2026-05-07
`CVE-2026-52854`	6.6	8.6	0.0058	2026-08-18