CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Vulnerabilities
How this weakness shows up in real applications — how it works, impact, and remediation:
Impactr finds and proves whether CWE-79 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.