CVE-2026-96230High· 8.8▾ MidnightPoC availableImproper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
1 GitHub repo
0.8% → 0.9%
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.AspNetCore.Components.WebAssembly.Server >= 10.0.0, <= 10.0.12Microsoft.AspNetCore.Components.WebAssembly.Server >= 11.0.0-preview.1, <= 11.0.0-rc.1Microsoft.AspNetCore.Components.WebAssembly.Server >= 8.0.0, <= 8.0.31Microsoft.AspNetCore.Components.WebAssembly.Server >= 9.0.0, <= 9.0.20Patched in:
Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-rc.2Microsoft.AspNetCore.Components.WebAssembly.Server 8.0.32Microsoft.AspNetCore.Components.WebAssembly.Server 9.0.21Source: https://github.com/advisories/GHSA-qjpx-jqm5-h2c4
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102870High· 8.8Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-97801High· 7.5Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
CVE-2020-1106Medium· 6.1A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1101Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1100Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1099Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server