CWE-87Improper Neutralization of Alternate XSS Syntax

Abstraction: Variant · CVEs in our corpus: 55

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Last updated: 22 August 2026 07:11 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 1 mapping(s) from 1 framework(s): CAPEC 1 (full)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SA-11 Developer Testing and Evaluation
SA-3 System Development Life Cycle
PR.PS-06
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-35161`	7.2	9.6	0.0238	2023-06-23
`CVE-2023-35156`	7.1	9.6	0.0208	2023-06-23
`CVE-2023-35158`	7.1	9.6	0.0205	2023-06-23
`CVE-2023-35159`	7.1	9.6	0.0218	2023-06-23
`CVE-2023-35160`	7.1	9.6	0.0227	2023-06-23
`CVE-2026-42235`	6.7	9.6	0.0033	2026-05-04
`CVE-2026-40321`	6.5	8.0	0.0760	2026-04-17
`CVE-2026-33506`	6.3	8.8	0.0046	2026-03-26
`CVE-2026-55237`	6.2	8.8	0.0032	2026-06-18
`CVE-2026-33510`	6.1	8.8	0.0023	2026-04-06
`CVE-2025-49137`	6.0	8.5	0.0023	2025-06-09
`CVE-2025-55291`	5.3	7.1	0.0023	2025-08-18
`CVE-2026-35534`	5.3	7.6	0.0017	2026-04-07
`CVE-2026-46492`	5.2	7.2	0.0023	2026-06-09
`CVE-2025-62414`	5.0	6.9	0.0026	2025-10-16
`CVE-2025-62415`	5.0	6.9	0.0026	2025-10-16
`CVE-2025-62418`	5.0	6.9	0.0026	2025-10-16
`CVE-2022-36033`	4.9	6.1	0.0123	2022-08-29
`CVE-2024-3162`	4.8	6.4	0.0032	2024-04-03
`CVE-2024-2750`	4.8	6.4	0.0032	2024-05-02
`CVE-2024-2618`	4.8	6.4	0.0032	2024-05-24
`CVE-2024-4459`	4.8	6.4	0.0034	2024-06-06
`CVE-2024-8505`	4.8	6.4	0.0036	2024-10-02
`CVE-2025-14732`	4.8	6.4	0.0034	2026-04-08
`CVE-2022-39295`	4.7	6.1	0.0057	2022-10-13