Cyber Resilience

CWE · MITRE source

CWE-83Improper Neutralization of Script in Attributes in a Web Page

Abstraction: Variant · CVEs in our corpus: 29

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Last updated: 20 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SI-10 Information Input Validation
  • SI-15 Information Output Filtering
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.4

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-37908 6.69.00.01062023-10-25
CVE-2026-451186.69.30.00382026-08-18
CVE-2023-32070 6.59.00.00652023-05-10
CVE-2025-58746 6.39.00.00312025-09-08
CVE-2024-525955.97.70.00472024-11-19
CVE-2026-457335.98.30.00302026-08-18
CVE-2024-26283 5.77.80.00282024-02-22
CVE-2025-4615 5.67.20.00742025-10-09
CVE-2026-58263 5.27.20.00182026-07-01
CVE-2024-9103 4.56.10.00222025-03-24
CVE-2025-67163 4.56.10.00242025-12-18
CVE-2026-15920 4.56.10.00302026-08-04
CVE-2026-538414.46.10.00192026-06-16
CVE-2022-39262 4.35.20.00652022-11-03
CVE-2026-456694.25.40.00182026-06-12
CVE-2026-537224.25.40.00202026-06-12
CVE-2026-23516 4.05.40.00142026-01-21
CVE-2026-8245 4.05.40.00142026-05-21
CVE-2026-623244.05.40.00182026-07-31
CVE-2023-30958 3.84.70.00402023-08-03
CVE-2026-22849 3.64.80.00212026-01-21
CVE-2020-14525 3.23.50.00472020-09-18
CVE-2025-27145 3.23.60.00462025-02-25