CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1133 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-31830 | Med | 0.38 | 5.9 | 0.01 | Jun 3, 2021 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered… | ||
| CVE-2021-33570 | Med | 0.38 | 5.4 | 0.04 | May 25, 2021 | Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving… | ||
| CVE-2021-24308 | Med | 0.38 | 5.4 | 0.03 | May 24, 2021 | The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site… | ||
| CVE-2021-24247 | Med | 0.38 | 5.4 | 0.05 | May 6, 2021 | The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be… | ||
| CVE-2021-29484 | Med | 0.38 | 6.8 | 0.08 | Apr 29, 2021 | Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter… | ||
| CVE-2021-31329 | Med | 0.38 | 5.4 | 0.02 | Apr 21, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php | ||
| CVE-2021-31327 | Med | 0.38 | 5.4 | 0.02 | Apr 21, 2021 | Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field. | ||
| CVE-2021-25679 | Med | 0.38 | 5.4 | 0.03 | Apr 20, 2021 | The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only… | ||
| CVE-2021-21087 | Med | 0.38 | 5.4 | 0.37 | Apr 15, 2021 | Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute… | ||
| CVE-2021-30637 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. | ||
| CVE-2021-30044 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php. | ||
| CVE-2021-30042 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php | ||
| CVE-2021-30039 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php. | ||
| CVE-2021-30034 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php. | ||
| CVE-2021-30030 | Med | 0.38 | 5.4 | 0.02 | Apr 13, 2021 | Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php. | ||
| CVE-2021-28935 | Med | 0.38 | 5.4 | 0.02 | Mar 30, 2021 | CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. | ||
| CVE-2021-21332 | Med | 0.38 | 6.9 | 0.01 | Mar 26, 2021 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting… | ||
| CVE-2020-23518 | Med | 0.38 | 5.4 | 0.02 | Mar 2, 2021 | Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2021-27370 | Med | 0.38 | 5.4 | 0.03 | Feb 22, 2021 | The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field. | ||
| CVE-2020-13409 | Med | 0.38 | 5.9 | 0.00 | Feb 9, 2021 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are… |
- risk 0.38cvss 5.9epss 0.01
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered…
- risk 0.38cvss 5.4epss 0.04
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving…
- risk 0.38cvss 5.4epss 0.03
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site…
- risk 0.38cvss 5.4epss 0.05
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be…
- risk 0.38cvss 6.8epss 0.08
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter…
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php
- risk 0.38cvss 5.4epss 0.02
Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.
- risk 0.38cvss 5.4epss 0.03
The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only…
- risk 0.38cvss 5.4epss 0.37
Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An attacker could abuse this vulnerability to execute…
- risk 0.38cvss 5.4epss 0.02
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinics/register.php
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php.
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
- risk 0.38cvss 5.4epss 0.02
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
- risk 0.38cvss 6.9epss 0.01
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting…
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.
- risk 0.38cvss 5.4epss 0.03
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
- risk 0.38cvss 5.9epss 0.00
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are…