CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1135 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-12882 | Med | 0.38 | 5.4 | 0.01 | May 15, 2020 | Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow. | ||
| CVE-2020-12706 | Med | 0.38 | 5.4 | 0.03 | May 7, 2020 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | ||
| CVE-2020-12261 | Med | 0.38 | 5.4 | 0.03 | Apr 28, 2020 | Open-AudIT 3.3.0 allows an XSS attack after login. | ||
| CVE-2020-1760 | Med | 0.38 | 5.8 | 0.02 | Apr 23, 2020 | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. | ||
| CVE-2020-10385 | Med | 0.38 | 5.4 | 0.04 | Mar 24, 2020 | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. | ||
| CVE-2020-10596 | Med | 0.38 | 5.4 | 0.03 | Mar 17, 2020 | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. | ||
| CVE-2020-8778 | Med | 0.38 | 5.4 | 0.03 | Mar 2, 2020 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project. | ||
| CVE-2020-8777 | Med | 0.38 | 5.4 | 0.03 | Mar 2, 2020 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document. | ||
| CVE-2020-8776 | Med | 0.38 | 5.4 | 0.03 | Mar 2, 2020 | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. | ||
| CVE-2012-1500 | Med | 0.38 | 5.4 | 0.01 | Feb 13, 2020 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. | ||
| CVE-2020-8825 | Med | 0.38 | 5.4 | 0.02 | Feb 10, 2020 | index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS. | ||
| CVE-2013-0161 | Med | 0.38 | 5.4 | 0.01 | Jan 29, 2020 | Havalite CMS 1.1.7 has a stored XSS vulnerability | ||
| CVE-2020-7934 | Med | 0.38 | 5.4 | 0.04 | Jan 28, 2020 | In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the… | ||
| CVE-2020-7108 | Med | 0.38 | 5.4 | 0.03 | Jan 16, 2020 | The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field. | ||
| CVE-2014-8674 | Med | 0.38 | 5.4 | 0.03 | Jan 6, 2020 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code. | ||
| CVE-2015-4039 | Med | 0.38 | 5.4 | 0.03 | Jan 6, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the… | ||
| CVE-2019-20204 | Med | 0.38 | 5.4 | 0.03 | Jan 2, 2020 | The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element. | ||
| CVE-2019-9556 | Med | 0.38 | 5.4 | 0.01 | Dec 31, 2019 | FiberHome an5506-04-f RP2669 devices have XSS. | ||
| CVE-2019-7004 | Med | 0.38 | 5.4 | 0.02 | Dec 12, 2019 | A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported… | ||
| CVE-2019-17225 | Med | 0.38 | 5.4 | 0.02 | Oct 6, 2019 | Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. |
- risk 0.38cvss 5.4epss 0.01
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- risk 0.38cvss 5.4epss 0.03
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php
- risk 0.38cvss 5.4epss 0.03
Open-AudIT 3.3.0 allows an XSS attack after login.
- risk 0.38cvss 5.8epss 0.02
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
- risk 0.38cvss 5.4epss 0.04
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
- risk 0.38cvss 5.4epss 0.03
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
- risk 0.38cvss 5.4epss 0.03
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.
- risk 0.38cvss 5.4epss 0.03
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.
- risk 0.38cvss 5.4epss 0.03
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
- risk 0.38cvss 5.4epss 0.01
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.
- risk 0.38cvss 5.4epss 0.02
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
- risk 0.38cvss 5.4epss 0.01
Havalite CMS 1.1.7 has a stored XSS vulnerability
- risk 0.38cvss 5.4epss 0.04
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the…
- risk 0.38cvss 5.4epss 0.03
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
- risk 0.38cvss 5.4epss 0.03
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
- risk 0.38cvss 5.4epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the…
- risk 0.38cvss 5.4epss 0.03
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- risk 0.38cvss 5.4epss 0.01
FiberHome an5506-04-f RP2669 devices have XSS.
- risk 0.38cvss 5.4epss 0.02
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported…
- risk 0.38cvss 5.4epss 0.02
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.