CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1138 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10309 | Med | 0.38 | 5.4 | 0.03 | Apr 24, 2018 | The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS. | ||
| CVE-2018-9034 | Med | 0.38 | 5.4 | 0.02 | Apr 4, 2018 | Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter. | ||
| CVE-2018-9237 | Med | 0.38 | 5.4 | 0.02 | Apr 4, 2018 | iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field. | ||
| CVE-2018-9236 | Med | 0.38 | 5.4 | 0.02 | Apr 4, 2018 | iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field. | ||
| CVE-2018-9183 | Med | 0.38 | 5.4 | 0.02 | Apr 2, 2018 | The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS. | ||
| CVE-2018-9163 | Med | 0.38 | 5.4 | 0.05 | Apr 2, 2018 | A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do. | ||
| CVE-2018-9172 | Med | 0.38 | 5.4 | 0.03 | Apr 1, 2018 | The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes. | ||
| CVE-2018-8903 | Med | 0.38 | 5.4 | 0.02 | Mar 22, 2018 | Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen. | ||
| CVE-2018-8732 | Med | 0.38 | 5.4 | 0.02 | Mar 19, 2018 | Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_del parameter. | ||
| CVE-2018-6227 | Med | 0.38 | 5.4 | 0.02 | Mar 15, 2018 | A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject client-side scripts into vulnerable systems. | ||
| CVE-2018-6226 | Med | 0.38 | 5.4 | 0.02 | Mar 15, 2018 | Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems. | ||
| CVE-2018-6936 | Med | 0.38 | 5.4 | 0.02 | Feb 21, 2018 | Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. | ||
| CVE-2018-6190 | Med | 0.38 | 5.4 | 0.02 | Jan 24, 2018 | Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page. | ||
| CVE-2018-5263 | Med | 0.38 | 5.4 | 0.02 | Jan 8, 2018 | The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS. | ||
| CVE-2017-14363 | Med | 0.38 | 5.9 | 0.01 | Dec 21, 2017 | Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). | ||
| CVE-2017-16819 | Med | 0.38 | 5.4 | 0.02 | Nov 17, 2017 | A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst (aka First Name) field for the employee details page (/employee.html) that is then reflected in… | ||
| CVE-2017-16843 | Med | 0.38 | 5.4 | 0.01 | Nov 16, 2017 | Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic. | ||
| CVE-2017-16807 | Med | 0.38 | 5.4 | 0.02 | Nov 13, 2017 | A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file. | ||
| CVE-2017-16781 | Med | 0.38 | 5.4 | 0.02 | Nov 10, 2017 | The installer in MyBB before 1.8.13 has XSS. | ||
| CVE-2017-16568 | Med | 0.38 | 5.4 | 0.02 | Nov 10, 2017 | Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the… |
- risk 0.38cvss 5.4epss 0.03
The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.
- risk 0.38cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.
- risk 0.38cvss 5.4epss 0.02
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
- risk 0.38cvss 5.4epss 0.02
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
- risk 0.38cvss 5.4epss 0.02
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
- risk 0.38cvss 5.4epss 0.05
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
- risk 0.38cvss 5.4epss 0.03
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
- risk 0.38cvss 5.4epss 0.02
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
- risk 0.38cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_del parameter.
- risk 0.38cvss 5.4epss 0.02
A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject client-side scripts into vulnerable systems.
- risk 0.38cvss 5.4epss 0.02
Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems.
- risk 0.38cvss 5.4epss 0.02
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
- risk 0.38cvss 5.4epss 0.02
Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.
- risk 0.38cvss 5.4epss 0.02
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.
- risk 0.38cvss 5.9epss 0.01
Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
- risk 0.38cvss 5.4epss 0.02
A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst (aka First Name) field for the employee details page (/employee.html) that is then reflected in…
- risk 0.38cvss 5.4epss 0.01
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.
- risk 0.38cvss 5.4epss 0.02
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
- risk 0.38cvss 5.4epss 0.02
The installer in MyBB before 1.8.13 has XSS.
- risk 0.38cvss 5.4epss 0.02
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the…