Compound weakness
Chain
Draft
CWE-692: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Last updated
5
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Compound
Abstraction
MITRE classification
Overview
While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.
Real-world CVEs
5 recorded CVEs are caused by CWE-692 (Incomplete Denylist to Cross-Site Scripting). The highest-severity and most recent are shown first. 1 new CWE-692 CVE has been recorded so far in 2026 (2 in 2025).