CWE-84
Improper Neutralization of Encoded URI Schemes in a Web Page
The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
Impactr finds and proves whether CWE-84 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.