VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (24,712)

page 1217 of 1,236
  • CVE-2007-6677Jan 10, 2008
    WordPress
    Peter's Random Anti-Spam Image
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the comment field in the comment form.

  • CVE-2008-0206Jan 10, 2008
    WordPress
    Captcha
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in captcha\captcha.php in the Captcha! 2.5d and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) captcha_ttffolder, (2) captcha_numchars, (3) captcha_ttfrange, or (4)…

  • CVE-2008-0205Jan 10, 2008
    WordPress
    Math Comment Spam Protection Plugin
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) mcsp_opt_msg_no_answer or (2)…

  • CVE-2008-0208Jan 10, 2008
    Snitz Communications
    Forums 2000
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login.asp in Snitz Forums 2000 3.4.05 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter.

  • CVE-2008-0204Jan 10, 2008
    WordPress
    Math Comment Spam Protection Plugin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in math-comment-spam-protection.php in the Math Comment Spam Protection 2.1 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) mcsp_opt_msg_no_answer or (2)…

  • CVE-2008-0203Jan 10, 2008
    WordPress
    Cryptographp
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cryptographp/admin.php in the Cryptographp 1.2 and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) cryptwidth, (2) cryptheight, (3) bgimg, (4) charR, (5) charG, (6)…

  • CVE-2008-0201Jan 10, 2008
    Expressionengine
    Expressionengine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.

  • CVE-2008-0200Jan 10, 2008
    RotaBanner
    RotaBanner Local
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in account/index.html in RotaBanner Local 3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) drop parameter.

  • CVE-2008-0197Jan 10, 2008
    WordPress
    Wp Contactform
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3)…

  • CVE-2008-0192Jan 10, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.

  • CVE-2007-5403Jan 9, 2008
    Layton Technology
    Helpbox
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Forename, (2) Surname, (3) Telephone, and (4) Fax fields to writeenduserenduser.asp; the (5) Filter field to…

  • CVE-2008-0134Jan 8, 2008
    Snitz Communications
    Forums 2000
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Forums/setup.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to inject arbitrary web script or HTML via the MAIL parameter.

  • CVE-2007-6674Jan 8, 2008
    Rapidshare
    Database
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Default.asp in RapidShare Database allows remote attackers to inject arbitrary web script or HTML via the Arayalim parameter.

  • CVE-2008-0131Jan 8, 2008
    Instantsoftwares
    Dating Site
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different product than CVE-2006-6022. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-0093Jan 8, 2008
    Eticket
    Eticket
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the (1) Name and (2) Subject parameters.

  • CVE-2007-6659Jan 4, 2008
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action…

  • CVE-2007-6643Jan 4, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-6637Jan 4, 2008
    Adobe Inc.
    Acrobat Connect
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector…

  • CVE-2007-6616Jan 3, 2008
    Simpleforum
    Simpleforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6617Jan 3, 2008
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to…