Reflected XSS in error message display
User input is reflected in error page without HTML encoding, allowing script injection in the browser context.
CWE
CWE-79
CVE
N/A
OWASP
A03:2021-Injection
CVSS Score
7.1
Source
SAST
Category
Cross-Site Scripting
Exploitability
Exploitable
Detected
2026-05-27 19:02
Code Location
src/Views/Error.cshtml:12@Html.Raw(ViewBag.ErrorMessage)
AI Explanation
Html.Raw() renders content without encoding. If ErrorMessage contains user input, an attacker can inject JavaScript that executes in other users' browsers.
Remediation Suggestion
Replace @Html.Raw() with @Html.Encode() or simply use @ViewBag.ErrorMessage which auto-encodes by default in Razor.
Change Status