We use web control adapter in our login page. Recently we run VeraCode on our web application. In following function, we got CWE80, Improper Neutralization of Script-Related
VeraCode lists Supported Cleansing Functions, including those CWE IDs that each function addresses.