Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Interpolating unescaped option values into <option> template strings and assigning to innerHTML can lead to Cross-Site Scripting (XSS). Use document.createElement('option') and assign textContent and value properties instead.
DOMPurify is configured with FORBID_TAGS but does not forbid 'iframe' tags or the 'srcdoc' attribute. DOMPurify does not parse or sanitize the content of the 'srcdoc' attribute, allowing arbitrary script execution via embedded iframe elements. Include 'iframe' in FORBID_TAGS and 'srcdoc' in FORBID_ATTR.
HTTP Referer header host is extracted and stored or rendered without domain validation or HTML escaping, which can lead to Stored Cross-Site Scripting (XSS).
Serving user files with a dynamic or inline Content-Disposition without setting a restrictive Content-Security-Policy header (e.g., 'sandbox') or resolving the disposition type safely can allow stored Cross-Site Scripting (XSS) if scriptable MIME types (e.g., HTML, XML) are rendered.
A hardcoded string constant is being used as a Content Security Policy (CSP) nonce. CSP nonces must be cryptographically random and unique per request. Hardcoded or predictable nonces allow attackers to bypass CSP script execution protections.
Overriding markdown-it fence rendering with incomplete Mermaid diagram detection and unescaped token content may allow Cross-Site Scripting (XSS).
The DocField configuration specifies 'ignore_xss_filter: 1', which bypasses Frappe's HTML sanitization routines and allows unsanitized user content to be stored and rendered, leading to stored Cross-Site Scripting (XSS).
Engagement metric endpoint (such as like, favorite, or vote) is registered without rate limiting, idempotency, or authentication middleware. Unrestricted repeated requests may lead to metric inflation and resource exhaustion.
Jinja template variable rendered inside an inline JavaScript event handler attribute. HTML entity autoescaping (e.g. ') does not prevent XSS in JavaScript execution contexts because the browser decodes HTML entities before executing inline script handlers. Use data-* attributes combined with separate JavaScript event listeners instead.
An uploaded file is saved directly from a generic Request instance without input validation. This can lead to unrestricted file uploads (CWE-434) and stored cross-site scripting (CWE-79) via dangerous file types such as SVG documents.
Directly outputting array elements without escaping can lead to Cross-Site Scripting (XSS). Use WordPress escaping functions such as esc_html(), esc_attr(), or esc_url() when rendering dynamic values.
Inline Markdown code span generation does not normalize newlines or carriage returns. Blank lines inside inline code spans can break out of the inline span and paragraph block, leading to raw HTML/Markdown injection.
HTML `<option>` tags are constructed with unescaped option body content. If the option display string contains user-controlled data, this can lead to Cross-Site Scripting (XSS). Ensure option strings are escaped before being appended into markup.
HTML attribute key and value are appended to a markup buffer without escaping, which can lead to Cross-Site Scripting (XSS).
Double quotes are being escaped using a backslash instead of HTML/markup entity escaping. In HTML attributes, backslash escaping does not neutralize quotes and allows attribute breakout and Cross-Site Scripting (XSS). Use proper HTML entity escaping methods such as `Strings.escapeMarkup(...)` or `StringEscapeUtils.escapeHtml4(...)`.
Text from a model is rendered into the component tag body without escaping HTML markup, which may lead to Cross-Site Scripting (XSS).
Unescaped property interpolation in a markdown-it-regexp replacement string can lead to stored Cross-Site Scripting (XSS). HTML-escape or sanitize dynamic properties before inserting them into HTML markup rendered by markdown-it.
Passing the return value of defaultNullLabel() directly to replaceComponentTagBody() can lead to Cross-Site Scripting (XSS) if defaultNullLabel() is overridden to return user-influenced data. Check getEscapeModelStrings() and escape markup using Strings.escapeMarkup().
Serving files using `send_file` without specifying `mimetype` or `as_attachment=True` can allow files with active extensions or polyglots to be served inline with attacker-controlled MIME types, leading to Cross-Site Scripting (XSS).
Cloned DOM nodes are projected and appended without propagating sanitization actions or re-sanitizing, which can bypass XSS filters if the original nodes contained deferred sanitization markers.
SVG attribute reference scrubbing checks strictly for 'xlink:href' instead of validating against all SVG href attributes (including 'href'). This allows non-local SVG URIs to bypass sanitization.
CGI.unescapeHTML does not decode semicolon-less numeric character references (such as : or :). Relying on CGI.unescapeHTML alone prior to URI scheme validation can allow malicious protocols like javascript: to bypass sanitization in web browsers.
URI normalization unescapes HTML entities during protocol validation without stripping HTML5 named whitespace character references (	 or 
). Browsers strip these references when parsing URIs, which allows obfuscated 'javascript:' URIs to bypass scheme validation.
Calling `wp_specialchars_decode()` on text and returning it without a subsequent `wp_kses()` or escaping call can re-arm nested or encoded HTML entities into active HTML tags, leading to Cross-Site Scripting (XSS).
