Common Weakness Enumeration

    CWE Definition / CWE-79

    CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:30 Apr 2026

    Related Weakness

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    CWE-494: Download of Code Without Integrity Check

    CWE-352: Cross-Site Request Forgery (CSRF)