Finding #56
Critical
Open
Reflected XSS in error message display

User input is reflected in error page without HTML encoding, allowing script injection in the browser context.


CWE

CWE-79

CVE

N/A

OWASP

A03:2021-Injection

CVSS Score

7.1

Source
SAST
Category

Cross-Site Scripting

Exploitability

Exploitable

Detected

2026-05-27 19:02

Code Location

src/Views/Error.cshtml:12
@Html.Raw(ViewBag.ErrorMessage)

AI Explanation

Html.Raw() renders content without encoding. If ErrorMessage contains user input, an attacker can inject JavaScript that executes in other users' browsers.

Remediation Suggestion

Replace @Html.Raw() with @Html.Encode() or simply use @ViewBag.ErrorMessage which auto-encodes by default in Razor.

Change Status

🛡️ Security AI