CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1134 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-13408 | Med | 0.38 | 5.9 | 0.00 | Feb 9, 2021 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are… | ||
| CVE-2020-13407 | Med | 0.38 | 5.9 | 0.00 | Feb 9, 2021 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are… | ||
| CVE-2021-3294 | Med | 0.38 | 5.4 | 0.03 | Feb 9, 2021 | CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website. | ||
| CVE-2020-18724 | Med | 0.38 | 5.4 | 0.03 | Feb 3, 2021 | Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list. | ||
| CVE-2020-18723 | Med | 0.38 | 5.4 | 0.04 | Feb 3, 2021 | Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities. | ||
| CVE-2021-3298 | Med | 0.38 | 5.4 | 0.02 | Jan 29, 2021 | Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter. | ||
| CVE-2021-3186 | Med | 0.38 | 5.4 | 0.03 | Jan 26, 2021 | A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter. | ||
| CVE-2020-29469 | Med | 0.38 | 5.4 | 0.01 | Dec 30, 2020 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie… | ||
| CVE-2020-29233 | Med | 0.38 | 5.4 | 0.01 | Dec 30, 2020 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the… | ||
| CVE-2020-27991 | Med | 0.38 | 5.4 | 0.34 | Nov 16, 2020 | Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). | ||
| CVE-2020-27990 | Med | 0.38 | 5.4 | 0.34 | Nov 16, 2020 | Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). | ||
| CVE-2020-27989 | Med | 0.38 | 5.4 | 0.34 | Nov 16, 2020 | Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). | ||
| CVE-2020-15274 | Med | 0.38 | 5.8 | 0.01 | Oct 26, 2020 | In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit… | ||
| CVE-2020-27533 | Med | 0.38 | 5.4 | 0.04 | Oct 22, 2020 | A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages. | ||
| CVE-2020-25270 | Med | 0.38 | 5.4 | 0.03 | Oct 8, 2020 | PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City. | ||
| CVE-2020-24963 | Med | 0.38 | 5.4 | 0.02 | Sep 4, 2020 | An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4. | ||
| CVE-2020-2230 | Med | 0.38 | 5.4 | 0.83 | Aug 12, 2020 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission. | ||
| CVE-2020-15038 | Med | 0.38 | 5.4 | 0.04 | Jun 24, 2020 | The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. | ||
| CVE-2020-14073 | Med | 0.38 | 5.4 | 0.03 | Jun 23, 2020 | XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps… | ||
| CVE-2020-14943 | Med | 0.38 | 5.4 | 0.04 | Jun 22, 2020 | The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile. |
- risk 0.38cvss 5.9epss 0.00
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are…
- risk 0.38cvss 5.9epss 0.00
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are…
- risk 0.38cvss 5.4epss 0.03
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.
- risk 0.38cvss 5.4epss 0.03
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
- risk 0.38cvss 5.4epss 0.04
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
- risk 0.38cvss 5.4epss 0.02
Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter.
- risk 0.38cvss 5.4epss 0.03
A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.
- risk 0.38cvss 5.4epss 0.01
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie…
- risk 0.38cvss 5.4epss 0.01
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the…
- risk 0.38cvss 5.4epss 0.34
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
- risk 0.38cvss 5.4epss 0.34
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
- risk 0.38cvss 5.4epss 0.34
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
- risk 0.38cvss 5.8epss 0.01
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit…
- risk 0.38cvss 5.4epss 0.04
A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages.
- risk 0.38cvss 5.4epss 0.03
PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.
- risk 0.38cvss 5.4epss 0.02
An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.
- risk 0.38cvss 5.4epss 0.83
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
- risk 0.38cvss 5.4epss 0.04
The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
- risk 0.38cvss 5.4epss 0.03
XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps…
- risk 0.38cvss 5.4epss 0.04
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile.