CWE-86
Improper Neutralization of Invalid Characters in Identifiers in Web Pages
The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
Impactr finds and proves whether CWE-86 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.