CVE-2026-96230High· 8.8▾ TwilightImproper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.AspNetCore.Components.WebAssembly.Server >= 10.0.0, <= 10.0.12Microsoft.AspNetCore.Components.WebAssembly.Server >= 11.0.0-preview.1, <= 11.0.0-rc.1Microsoft.AspNetCore.Components.WebAssembly.Server >= 8.0.0, <= 8.0.31Microsoft.AspNetCore.Components.WebAssembly.Server >= 9.0.0, <= 9.0.20Patched in:
Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-rc.2Microsoft.AspNetCore.Components.WebAssembly.Server 8.0.32Microsoft.AspNetCore.Components.WebAssembly.Server 9.0.21Connected by shared product, vendor, weakness, or advisory.
CVE-2020-1106Medium· 6.1A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1101Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1100Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1099Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1055Medium· 5.5A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs
CVE-2026-102870High· 8.8Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.