CWE-692
Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Impactr finds and proves whether CWE-692 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.