CWEweakness

CWE-692 Incomplete Denylist to Cross-Site Scripting

Official page ↗
Abstraction
Compound
Structure
Chain
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.

Common consequences

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands — Attackers could create XSS variants that still work. While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.

Observed examples

• CVE-2007-5727: Denylist only removes <SCRIPT> tag. • CVE-2006-3617: Denylist only removes <SCRIPT> tag. • CVE-2006-4308: Denylist only checks "javascript:" tag

Related

Attack pattern · CAPEC (5)

  • CAPEC-120 Double Encoding attack pattern
  • CAPEC-267 Leverage Alternate Encoding attack pattern
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic attack pattern
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern
  • CAPEC-85 AJAX Footprinting attack pattern

Observed example · CVE (3)

  • CVE-2007-5727 Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other… vulnerability
  • CVE-2006-4308 Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite… vulnerability
  • CVE-2006-3617 Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers… vulnerability

Child of · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

Starts with · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

Referenced by CAPEC · weakness (5)

  • CAPEC-120 Double Encoding attack pattern
  • CAPEC-267 Leverage Alternate Encoding attack pattern
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic attack pattern
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern
  • CAPEC-85 AJAX Footprinting attack pattern

Referenced by CVE · weakness (11)

  • CVE-2026-107396 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. vulnerability
  • CVE-2026-71478 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. vulnerability
  • CVE-2024-23569 HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header vulnerability
  • CVE-2024-42214 HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. vulnerability
  • CVE-2026-15295 The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all… vulnerability
  • CVE-2025-20240 A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a… vulnerability
  • CVE-2025-53904 The Scratch Channel is a news website that is under development as of time of this writing. vulnerability
  • CVE-2025-49590 CryptPad is a collaboration suite. vulnerability
  • CVE-2024-52305 UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. vulnerability
  • CVE-2024-30924 Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component. vulnerability
  • CVE-2023-26047 teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. vulnerability