CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1003 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-5249 | Med | 0.40 | 6.1 | 0.01 | Jan 5, 2018 | Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php). | ||
| CVE-2017-1673 | Med | 0.40 | 6.1 | 0.01 | Jan 4, 2018 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2017-14383 | Med | 0.40 | 6.1 | 0.01 | Jan 4, 2018 | In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated… | ||
| CVE-2017-1000492 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2018 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration | ||
| CVE-2017-1000459 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2018 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes | ||
| CVE-2017-1000427 | Med | 0.40 | 6.1 | 0.02 | Jan 2, 2018 | marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. | ||
| CVE-2017-1000443 | Med | 0.40 | 6.1 | 0.01 | Jan 2, 2018 | Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code execution in the browser. | ||
| CVE-2017-18015 | Med | 0.40 | 6.1 | 0.01 | Jan 2, 2018 | The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter. | ||
| CVE-2017-18012 | Med | 0.40 | 6.1 | 0.01 | Jan 1, 2018 | The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter. | ||
| CVE-2017-18011 | Med | 0.40 | 6.1 | 0.02 | Jan 1, 2018 | The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter. | ||
| CVE-2017-18010 | Med | 0.40 | 6.1 | 0.01 | Jan 1, 2018 | The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter. | ||
| CVE-2017-18006 | Med | 0.40 | 6.1 | 0.01 | Jan 1, 2018 | netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447. | ||
| CVE-2016-10704 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2017 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503. | ||
| CVE-2017-12813 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2017 | PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section. | ||
| CVE-2017-12812 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2017 | PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab. | ||
| CVE-2017-12811 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2017 | PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item. | ||
| CVE-2017-12810 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2017 | PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel. | ||
| CVE-2017-17933 | Med | 0.40 | 6.1 | 0.01 | Dec 29, 2017 | cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter. | ||
| CVE-2017-17958 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter. | ||
| CVE-2017-17956 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).
- risk 0.40cvss 6.1epss 0.01
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.01
In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated…
- risk 0.40cvss 6.1epss 0.01
Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
- risk 0.40cvss 6.1epss 0.01
Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes
- risk 0.40cvss 6.1epss 0.02
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
- risk 0.40cvss 6.1epss 0.01
Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code execution in the browser.
- risk 0.40cvss 6.1epss 0.01
The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.
- risk 0.40cvss 6.1epss 0.01
The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.
- risk 0.40cvss 6.1epss 0.02
The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.
- risk 0.40cvss 6.1epss 0.01
The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.
- risk 0.40cvss 6.1epss 0.01
netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug Bounty ID OBB-290447.
- risk 0.40cvss 6.1epss 0.01
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
- risk 0.40cvss 6.1epss 0.01
PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.
- risk 0.40cvss 6.1epss 0.01
PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.
- risk 0.40cvss 6.1epss 0.01
PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.
- risk 0.40cvss 6.1epss 0.01
PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
- risk 0.40cvss 6.1epss 0.01
cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.