CWE-451 on ZAP

DOM-based Link Manipulation (taint flow)

Mon, 01 Jan 0001 00:00:00 +0000

Detects DOM code that rewrites link destinations (href attributes) with attacker-controlled data. Manipulated links can mislead users into visiting malicious targets even if navigation is not forced automatically.

Generated by OWASP PTK SAST Module

IFrame content injection via srcdoc

Mon, 01 Jan 0001 00:00:00 +0000

Tainted HTML assigned to iframe.srcdoc, enabling DOM-based XSS inside the frame.

Generated by OWASP PTK IAST Module

IFrame navigation via src

Mon, 01 Jan 0001 00:00:00 +0000

Tainted URL assigned to iframe.src, causing navigation to untrusted content.

Generated by OWASP PTK IAST Module

Review assignments to href/src/action

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK SAST Module

Untrusted DOM data into createHTMLDocument

Mon, 01 Jan 0001 00:00:00 +0000

Detects untrusted DOM data being written into form metadata (formAction/target/method/value/placeholder), inline style surfaces (style/cssText/background*), document.title, history state, or createHTMLDocument — mutations that influence UI/navigation state without covering classic href/src/action sinks already handled elsewhere.

Generated by OWASP PTK SAST Module

Untrusted DOM data into navigation-adjacent sinks

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK SAST Module

Untrusted DOM data into UI mutation sinks

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK SAST Module