CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1025 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-8920 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS. | ||
| CVE-2017-9332 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag. | ||
| CVE-2017-9420 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2017 | Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter. | ||
| CVE-2017-8440 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2017 | Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. | ||
| CVE-2017-8439 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2017 | Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users. | ||
| CVE-2012-6705 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2017 | Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field. | ||
| CVE-2017-9361 | Med | 0.40 | 6.1 | 0.01 | Jun 2, 2017 | WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php. | ||
| CVE-2017-7384 | Med | 0.40 | 6.1 | 0.01 | Jun 1, 2017 | Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter. | ||
| CVE-2017-3127 | Med | 0.40 | 6.1 | 0.01 | Jun 1, 2017 | A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation. | ||
| CVE-2017-9337 | Med | 0.40 | 6.1 | 0.01 | Jun 1, 2017 | The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post. | ||
| CVE-2017-9336 | Med | 0.40 | 6.1 | 0.01 | Jun 1, 2017 | The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post. | ||
| CVE-2017-9306 | Med | 0.40 | 6.1 | 0.01 | May 31, 2017 | inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring. | ||
| CVE-2017-9305 | Med | 0.40 | 6.1 | 0.01 | May 31, 2017 | lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php. | ||
| CVE-2017-2307 | Med | 0.40 | 6.1 | 0.01 | May 30, 2017 | A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space. | ||
| CVE-2017-9299 | Med | 0.40 | 6.1 | 0.01 | May 29, 2017 | Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20… | ||
| CVE-2017-9292 | Med | 0.40 | 6.1 | 0.01 | May 29, 2017 | Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782. | ||
| CVE-2017-9289 | Med | 0.40 | 6.1 | 0.01 | May 29, 2017 | Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter). | ||
| CVE-2017-9288 | Med | 0.40 | 6.1 | 0.04 | May 29, 2017 | The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). | ||
| CVE-2017-9252 | Med | 0.40 | 6.1 | 0.01 | May 28, 2017 | andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action. | ||
| CVE-2017-9251 | Med | 0.40 | 6.1 | 0.01 | May 28, 2017 | andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php. |
- risk 0.40cvss 6.1epss 0.01
irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.
- risk 0.40cvss 6.1epss 0.01
The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
- risk 0.40cvss 6.1epss 0.01
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
- risk 0.40cvss 6.1epss 0.01
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.
- risk 0.40cvss 6.1epss 0.01
WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation.
- risk 0.40cvss 6.1epss 0.01
The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
- risk 0.40cvss 6.1epss 0.01
The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
- risk 0.40cvss 6.1epss 0.01
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
- risk 0.40cvss 6.1epss 0.01
lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
- risk 0.40cvss 6.1epss 0.01
A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.
- risk 0.40cvss 6.1epss 0.01
Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20…
- risk 0.40cvss 6.1epss 0.01
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782.
- risk 0.40cvss 6.1epss 0.01
Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter).
- risk 0.40cvss 6.1epss 0.04
The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).
- risk 0.40cvss 6.1epss 0.01
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.
- risk 0.40cvss 6.1epss 0.01
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.