← Back
CWE-84

22 CVEs • Abstraction: Variant

Improper Neutralization of Encoded URI Schemes in a Web Page

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

JSON object

Loading...

CVEs (22)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-3824
1Openvpn
1Openvpn Access Server
Jun 17, 2026
Sep 23, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.
CVE-2020-7011
1Elastic
1Elastic App Search
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web...Show more
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser.Show less