CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1023 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-6700 | Med | 0.40 | 6.1 | 0.01 | Jul 4, 2017 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a Document Object Model (DOM) based (environment or client-side) cross-site… | ||
| CVE-2017-6699 | Med | 0.40 | 6.1 | 0.01 | Jul 4, 2017 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based… | ||
| CVE-2016-6201 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2017 | Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx. | ||
| CVE-2016-6127 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2017 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with… | ||
| CVE-2017-10798 | Med | 0.40 | 6.1 | 0.01 | Jul 3, 2017 | In ObjectPlanet Opinio before 7.6.4, there is XSS. | ||
| CVE-2017-10795 | Med | 0.40 | 6.1 | 0.01 | Jul 2, 2017 | Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069. | ||
| CVE-2017-10673 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2017 | admin/profile.php in GetSimple CMS 3.x has XSS in a name field. | ||
| CVE-2017-10667 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2017 | In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS. | ||
| CVE-2017-9145 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2017 | TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS. | ||
| CVE-2017-7416 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2017 | ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated. | ||
| CVE-2017-9356 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2017 | Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI. | ||
| CVE-2017-6053 | Med | 0.40 | 6.1 | 0.01 | Jun 21, 2017 | A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser. | ||
| CVE-2017-9781 | Med | 0.40 | 6.1 | 0.01 | Jun 21, 2017 | A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded… | ||
| CVE-2017-9668 | Med | 0.40 | 6.1 | 0.01 | Jun 18, 2017 | In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. | ||
| CVE-2016-10366 | Med | 0.40 | 6.1 | 0.01 | Jun 16, 2017 | Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack. | ||
| CVE-2015-9056 | Med | 0.40 | 6.1 | 0.01 | Jun 16, 2017 | Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack. | ||
| CVE-2017-9419 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2017 | Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter. | ||
| CVE-2017-8551 | Med | 0.40 | 6.1 | 0.03 | Jun 15, 2017 | An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability". | ||
| CVE-2017-8550 | Med | 0.40 | 5.4 | 0.22 | Jun 15, 2017 | A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability". | ||
| CVE-2017-9624 | Med | 0.40 | 6.1 | 0.01 | Jun 14, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data. |
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a Document Object Model (DOM) based (environment or client-side) cross-site…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with…
- risk 0.40cvss 6.1epss 0.01
In ObjectPlanet Opinio before 7.6.4, there is XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.
- risk 0.40cvss 6.1epss 0.01
admin/profile.php in GetSimple CMS 3.x has XSS in a name field.
- risk 0.40cvss 6.1epss 0.01
In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.
- risk 0.40cvss 6.1epss 0.01
TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
- risk 0.40cvss 6.1epss 0.01
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.
- risk 0.40cvss 6.1epss 0.01
Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow JavaScript code supplied by the attacker to execute within the user's browser.
- risk 0.40cvss 6.1epss 0.01
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded…
- risk 0.40cvss 6.1epss 0.01
In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.
- risk 0.40cvss 6.1epss 0.01
Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.
- risk 0.40cvss 6.1epss 0.01
Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
- risk 0.40cvss 6.1epss 0.03
An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".
- risk 0.40cvss 5.4epss 0.22
A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data.