recorded together · two weakness classes
Cross-site Scripting and Input Validation and Logic
37 CVEs
37 CVEs name a weakness of both Cross-site Scripting and Input Validation and Logic, fewer than chance alone would give (about 88). The pairing most often behind it is CWE-79 (Cross-site Scripting) with CWE-184 (Incomplete List of Disallowed Inputs), in 18 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 37
- Chance alone would give
- about 88
- So they are recorded together
- less often than chance (0.4×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial only for pairs with enough CVEs and clearly above chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
Every one of the 37 is a mark on the map. Named now: 1 to 26, most at risk first.
- Astro - Unauthorized Third-Party Image Access
- Passing in a non-string 'html' argument can lead to unsanitized output
- SVGO: removeScripts allows executable links through namespace and control-character bypasses
- HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
- @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
- NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
- CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
- SVGO: removeScripts plugin leaves some executable scripts intact
- Loofah allowed_uri? treats data:text/html as safe text/plain
- Loofah allowed_uri? treats javascript: alert(1) as safe
- Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
- Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
- Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
- Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
- Ghost: Stored XSS via oEmbed Photo Responses
- SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
- Astro: XSS via attribute injection in dynamic tag names
- backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
- DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
- SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
- lxml: javascript: URL bypass in Cleaner via xlink:href
- DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
- Promptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG
- TYPO3 HTML Sanitizer allows Cross-Site Scripting
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.