The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.