Cyber Resilience

CWE · MITRE source

CWE-84Improper Neutralization of Encoded URI Schemes in a Web Page

Abstraction: Variant · CVEs in our corpus: 20

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

Last updated: 20 August 2026 13:14 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SI-10 Information Input Validation
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-40181 6.48.30.00882022-10-11
CVE-2023-25571 5.16.80.00452023-02-14
CVE-2024-450454.96.30.00292024-08-29
CVE-2020-7011 4.86.10.00982020-06-03
CVE-2021-3824 4.76.10.00752021-09-23
CVE-2024-52890 4.46.10.00182025-08-05
CVE-2026-673384.46.10.00182026-08-01
CVE-2025-25323 4.25.50.00182025-02-27
CVE-2025-25324 4.25.50.00182025-02-27
CVE-2025-25325 4.25.50.00182025-02-27
CVE-2025-25326 4.25.50.00182025-02-27
CVE-2025-25330 4.25.50.00182025-02-27
CVE-2025-25331 4.25.50.00182025-02-27
CVE-2025-25334 4.25.50.00182025-02-27
CVE-2025-25329 4.25.50.00182025-02-27
CVE-2025-30203 3.74.80.00282025-03-31
CVE-2023-30959 3.34.10.00312023-09-27
CVE-2024-42184 2.12.50.00142025-01-23