CWE-79 · High · OWASP A05:2025

CWE-79: Cross-site Scripting (XSS)

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page served to other users.

Full guideDOM XSS via innerHTML: why it happens and what to use instead →Vulnerable and fixed code side by side, how to find it in your codebase, and a fix checklist.

About CWE-79

CWE-79 (Cross-site Scripting (XSS)) is classified as high severity and falls under the OWASP Top 10 category A05:2025.

The official CWE entry is maintained by MITRE at cwe.mitre.org/data/definitions/79.html.

References

Detect CWE-79 automatically

Orbis AppSec automatically detects and fixes Cross-site Scripting (XSS) vulnerabilities in your code with AI-powered static analysis.

View related fixesTry Orbis AppSec