VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (22,695)

page 1130 of 1,135
  • CVE-2006-3761Jul 21, 2006
    PhpBB
    Mybulletinboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as…

  • CVE-2006-3579Jul 13, 2006
    Fujitsu
    Serverview
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-3539Jul 13, 2006
    Dkscript
    Dragons Kingdom Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DKScript.com Dragon's Kingdom Script 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) Subject and (2) Message fields in a do=write (aka…

  • CVE-2006-3306Jun 29, 2006
    Zoid Technologies
    Project Eros Bbsengine
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown…

  • CVE-2006-3240Jun 27, 2006
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in classes/ui.class.php in dotProject 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.

  • CVE-2006-3211Jun 24, 2006
    Cjguestbook Project
    Cjguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject Javascript code via a javascript URI in an img bbcode tag in the comments parameter.

  • CVE-2006-3138Jun 22, 2006
    Accomplishtechnology
    Phpmydirectory
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PIC parameter in offers-pix.php, (2) from parameter in cp/index.php, and (3) action parameter in cp/admin_index.php.

  • CVE-2006-3087Jun 19, 2006
    Ezgallery
    Ezgallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EZGallery 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pUserID, (2) aid, (3) aname, (4) uid, and (5) m parameter in (a) common/galleries.asp; (6) aid, (7) aname, (8) uid, (9) m,…

  • CVE-2006-3047Jun 16, 2006
    Tiki
    Tikiwiki CMS\/groupware
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-2994Jun 13, 2006
    Christian Becher
    Phazizguestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in phazizGuestbook 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, (3) url fields, and (4) text field (content parameter).

  • CVE-2006-2951Jun 12, 2006
    Npds
    Npds
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the (1) Titlesitename or (2) sitename parameter to (a) header.php, (3) nuke_url parameter to (b)…

  • CVE-2006-2816Jun 5, 2006
    Coolphp
    Coolphp Magazine
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in coolphp magazine allow remote attackers to inject arbitrary web script or HTML via the (1) op and (2) nick parameters, and possibly the (3) 0000, (4) userinfo, (5) comp_der, (6) encuestas, and (7) pagina…

  • CVE-2006-2815Jun 5, 2006
    Two Shoes Mambo Factory
    Simpleboard
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used in Mambo and Joomla!, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in "post ne topic" in the…

  • CVE-2006-2800Jun 3, 2006
    Unak
    Unak CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u_a or (2) u_s parameters. NOTE: this might be resultant from SQL injection.

  • CVE-2006-2796Jun 3, 2006
    New Place
    Captivate
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message.

  • CVE-2006-2783Jun 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark (BOM) from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a BOM sequence in the middle of a dangerous tag such…

  • CVE-2006-2663May 30, 2006
    Ifusionservices
    Iflance
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in iFlance 1.1 allow remote attackers to inject arbitrary web script or HTML via certain inputs to (1) acc_verify.php or (2) project.php.

  • CVE-2006-2669May 30, 2006
    Preprojects
    Pre Shopping Mall
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter in search.php (the "search box"), (2) the prodid parameter in detail.php, and the (3) cid parameter in…

  • CVE-2006-2649May 30, 2006
    Cosmicphp
    Cosmicshoppingcart
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow remote attackers to inject arbitrary web script or HTML via multiple unspecified…

  • CVE-2006-2618May 26, 2006
    Alstrasoft
    Webhost Directory
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, might allow remote attackers to inject arbitrary web script or HTML via the "write a review" box. NOTE: since user reviews do not require administrator…