CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1004 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-17955 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter. | ||
| CVE-2017-17954 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter. | ||
| CVE-2017-17953 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter. | ||
| CVE-2017-17949 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter. | ||
| CVE-2017-17948 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request. | ||
| CVE-2017-17937 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2017 | Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search. | ||
| CVE-2015-7668 | Med | 0.40 | 6.1 | 0.02 | Dec 27, 2017 | Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter. | ||
| CVE-2015-7667 | Med | 0.40 | 6.1 | 0.02 | Dec 27, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter. | ||
| CVE-2015-7324 | Med | 0.40 | 6.1 | 0.02 | Dec 27, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment. | ||
| CVE-2017-17911 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503. | ||
| CVE-2017-17907 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter. | ||
| CVE-2017-17896 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | Readymade Job Site Script has XSS via the keyword parameter to the /job URI. | ||
| CVE-2017-17893 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | Readymade Video Sharing Script has XSS via the search_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter. | ||
| CVE-2017-17869 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter. | ||
| CVE-2017-17868 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag. | ||
| CVE-2017-17859 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2017 | Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another… | ||
| CVE-2017-17826 | Med | 0.40 | 6.1 | 0.01 | Dec 21, 2017 | The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration§ion=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it. | ||
| CVE-2011-4955 | Med | 0.40 | 6.1 | 0.02 | Dec 20, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php. | ||
| CVE-2017-4940 | Med | 0.40 | 6.1 | 0.01 | Dec 20, 2017 | The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting… | ||
| CVE-2017-17792 | Med | 0.40 | 6.1 | 0.01 | Dec 20, 2017 | Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment. |
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
- risk 0.40cvss 6.1epss 0.01
Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
- risk 0.40cvss 6.1epss 0.01
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
- risk 0.40cvss 6.1epss 0.01
Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.
- risk 0.40cvss 6.1epss 0.01
packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
- risk 0.40cvss 6.1epss 0.01
Readymade Job Site Script has XSS via the keyword parameter to the /job URI.
- risk 0.40cvss 6.1epss 0.01
Readymade Video Sharing Script has XSS via the search_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter.
- risk 0.40cvss 6.1epss 0.01
The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.
- risk 0.40cvss 6.1epss 0.01
In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.
- risk 0.40cvss 6.1epss 0.01
Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another…
- risk 0.40cvss 6.1epss 0.01
The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration§ion=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php.
- risk 0.40cvss 6.1epss 0.01
The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker can exploit this vulnerability by injecting…
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.