CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1137 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-18417 | Med | 0.38 | 5.4 | 0.02 | Oct 19, 2018 | In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI. | ||
| CVE-2015-4631 | Med | 0.38 | 5.4 | 0.04 | Oct 18, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value… | ||
| CVE-2018-11075 | Med | 0.38 | 5.8 | 0.01 | Sep 28, 2018 | RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by… | ||
| CVE-2018-16736 | Med | 0.38 | 5.4 | 0.03 | Sep 9, 2018 | In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings). | ||
| CVE-2018-14059 | Med | 0.38 | 5.4 | 0.03 | Aug 24, 2018 | Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions. | ||
| CVE-2018-14869 | Med | 0.38 | 5.4 | 0.02 | Aug 6, 2018 | PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile. | ||
| CVE-2018-14497 | Med | 0.38 | 5.4 | 0.02 | Aug 4, 2018 | Tenda D152 ADSL routers allow XSS via a crafted SSID. | ||
| CVE-2018-1513 | Med | 0.38 | 5.4 | 0.03 | Jul 23, 2018 | IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within… | ||
| CVE-2018-1563 | Med | 0.38 | 5.4 | 0.03 | Jul 20, 2018 | IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2018-5754 | Med | 0.38 | 5.4 | 0.03 | Jun 16, 2018 | Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the… | ||
| CVE-2018-12094 | Med | 0.38 | 5.4 | 0.02 | Jun 11, 2018 | Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | ||
| CVE-2018-11715 | Med | 0.38 | 5.4 | 0.02 | Jun 4, 2018 | The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject. | ||
| CVE-2018-11403 | Med | 0.38 | 5.4 | 0.02 | May 24, 2018 | DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter. | ||
| CVE-2018-10580 | Med | 0.38 | 5.4 | 0.02 | May 11, 2018 | The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field. | ||
| CVE-2018-10314 | Med | 0.38 | 5.4 | 0.02 | May 10, 2018 | Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section. | ||
| CVE-2018-10259 | Med | 0.38 | 5.4 | 0.02 | May 1, 2018 | An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. | ||
| CVE-2018-10365 | Med | 0.38 | 5.4 | 0.01 | May 1, 2018 | An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized. | ||
| CVE-2018-7465 | Med | 0.38 | 5.4 | 0.02 | Apr 26, 2018 | An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after… | ||
| CVE-2018-10310 | Med | 0.38 | 5.4 | 0.04 | Apr 25, 2018 | A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser. | ||
| CVE-2018-10313 | Med | 0.38 | 5.4 | 0.02 | Apr 24, 2018 | WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI. |
- risk 0.38cvss 5.4epss 0.02
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
- risk 0.38cvss 5.4epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value…
- risk 0.38cvss 5.8epss 0.01
RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by…
- risk 0.38cvss 5.4epss 0.03
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
- risk 0.38cvss 5.4epss 0.03
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
- risk 0.38cvss 5.4epss 0.02
PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile.
- risk 0.38cvss 5.4epss 0.02
Tenda D152 ADSL routers allow XSS via a crafted SSID.
- risk 0.38cvss 5.4epss 0.03
IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…
- risk 0.38cvss 5.4epss 0.03
IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.38cvss 5.4epss 0.03
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the…
- risk 0.38cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- risk 0.38cvss 5.4epss 0.02
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
- risk 0.38cvss 5.4epss 0.02
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
- risk 0.38cvss 5.4epss 0.02
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
- risk 0.38cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.
- risk 0.38cvss 5.4epss 0.02
An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
- risk 0.38cvss 5.4epss 0.01
An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized.
- risk 0.38cvss 5.4epss 0.02
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after…
- risk 0.38cvss 5.4epss 0.04
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.
- risk 0.38cvss 5.4epss 0.02
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.