Skip to content
OpenAdvisories

Weakness (CWE)

CWE-692: Incomplete Denylist to Cross-Site Scripting

Compound Draft Mapping discouraged

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete.

Source: MITRE CWE-692

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 1.3
    CVE-2025-53904

    The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability

    The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publication.

    The-Scratch-Channel the-scratch-channel.github.io
  • Low 2.9
    CVE-2025-49590

    CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability

    CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the …

    cryptpad cryptpad