Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Property	Value
Language	java
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being directly inserted into manually constructed HTML strings before being sent in a response. This bypasses built-in HTML escaping and can allow malicious input to be rendered as executable code in a user's browser.

Impact

If exploited, attackers can inject scripts (Cross-Site Scripting/XSS), leading to theft of user data, session hijacking, or manipulation of the application's content. This can compromise user trust and expose sensitive information.