Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Using eval() in JavaScript can execute code from user input, which is dangerous because it may allow attackers to inject malicious scripts. This practice makes your application vulnerable to cross-site scripting (XSS) attacks.

Impact

If exploited, attackers can run arbitrary JavaScript in users’ browsers, leading to data theft, session hijacking, defacement, or spreading malware. This compromises user trust and may result in data breaches or regulatory penalties.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being sent directly in an Ok() HTTP response as HTML, without proper escaping or sanitization. This bypasses the view/template system and can allow attackers to inject malicious scripts into the page.

Impact

If exploited, an attacker could perform cross-site scripting (XSS), enabling them to steal user data, hijack sessions, or deface the site. This can lead to compromised user accounts, data breaches, and damage to your application’s reputation.

Property
Language	java
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

User input from the HttpServletRequest is being written directly to the HTTP response without proper encoding. This allows attackers to inject malicious scripts into web pages, leading to cross-site scripting (XSS) vulnerabilities.

Impact

If exploited, an attacker could execute arbitrary JavaScript in users’ browsers, potentially stealing session cookies, defacing the site, or performing actions on behalf of users. This can compromise user data, damage trust, and expose the organization to compliance risks.

Property
Language	java
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

The custom XSSRequestWrapper implementation uses insecure filtering techniques to remove malicious input, but attackers can easily bypass these filters to inject harmful scripts. Relying on such manual filtering instead of robust, well-maintained libraries leaves your application vulnerable to XSS attacks.

Property
Language	java
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being written directly to an OutputStream or Writer in a servlet response, bypassing view technologies that normally escape HTML. This can allow attackers to inject malicious scripts into web pages.

Impact

If exploited, attackers can perform cross-site scripting (XSS) attacks, leading to theft of user data, session hijacking, or defacement of your site. This exposes both users and the organization to significant security and reputational risks.

Property
Language	java
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being directly inserted into manually constructed HTML strings before being sent in a response. This bypasses built-in HTML escaping and can allow malicious input to be rendered as executable code in a user’s browser.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Low
Likelihood Level	Low

Description

Allowing dangerous HTML, disabling HTML escaping, or insecurely customizing link or image URI handling in react-markdown can make your app vulnerable to cross-site scripting (XSS) attacks. This happens when untrusted user content is rendered without proper sanitization.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

Assigning dynamic or user-provided values directly to DOM properties like innerHTML or outerHTML in React can allow malicious scripts to be injected and executed. Always sanitize any HTML content before inserting it into the DOM.

Impact

If exploited, attackers could execute arbitrary JavaScript in users’ browsers, leading to data theft, account compromise, or defacement of your site. This cross-site scripting (XSS) vulnerability can undermine user trust and expose sensitive information.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

Rendering HTML content from dynamic or user-supplied input directly into the DOM (e.g., using document.write, insertAdjacentHTML) without sanitization exposes your app to Cross-Site Scripting (XSS) attacks. Always sanitize HTML input before rendering it in React applications.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

Using React’s dangerouslySetInnerHTML with dynamic or user-provided data can expose your app to cross-site scripting (XSS) attacks. This happens when unsanitized HTML is injected directly into the DOM, allowing attackers to run malicious scripts.

Impact

If exploited, attackers could steal user data, hijack sessions, or deface your site by executing malicious JavaScript in your users’ browsers. This compromises user trust and can lead to data breaches or compliance violations.