CWE-83
Improper Neutralization of Script in Attributes in a Web Page
The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Impactr finds and proves whether CWE-83 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.