VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1329 of 2,429
  • CVE-2023-49987MedMar 7, 2024
    Oretnom23
    School Fees Management System
    risk 0.35cvss 5.4epss 0.00

    A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter.

  • CVE-2024-27287MedMar 6, 2024
    Esphome
    Esphome
    risk 0.35cvss 6.5epss 0.01

    ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant…

  • CVE-2023-50167MedMar 6, 2024
    Pega
    Platform
    risk 0.35cvss 5.4epss 0.00

    Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.

  • CVE-2024-28149MedMar 6, 2024
    Jenkins Project
    HTML Publisher
    risk 0.35cvss 6.5epss 0.01

    Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.

  • CVE-2024-20346MedMar 6, 2024
    Cisco Systems, Inc.
    Appdynamics Controller
    risk 0.35cvss 5.4epss 0.00

    A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to…

  • CVE-2023-49977MedMar 6, 2024
    Customer Support System
    Customer Support System
    risk 0.35cvss 5.4epss 0.00

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer.

  • CVE-2023-49976MedMar 6, 2024
    Customer Support System
    Customer Support System
    risk 0.35cvss 5.4epss 0.00

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customer_support/index.php?page=new_ticket.

  • CVE-2024-27278MedMar 6, 2024
    OpenPNE
    opTimelinePlugin
    risk 0.35cvss 5.4epss 0.00

    OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected product, when a user configures the profile with some malicious contents, an arbitrary script may be executed on the web browsers of other…

  • CVE-2024-0698MedMar 5, 2024
    Alextselegidis
    Easyappointments
    risk 0.35cvss 6.4epss 0.00

    The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2024-1449MedMar 2, 2024
    WordPress
    Master Slider
    risk 0.35cvss 6.4epss 0.00

    The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'src' user supplied…

  • CVE-2024-25434MedMar 1, 2024
    Pkp Ojs
    Pkp Ojs
    risk 0.35cvss 5.4epss 0.00

    A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter.

  • CVE-2024-27499MedMar 1, 2024
    Bagisto
    Bagisto
    risk 0.35cvss 6.5epss 0.01

    Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.

  • CVE-2024-27140MedMar 1, 2024
    Apache
    Archiva
    risk 0.35cvss 5.4epss 0.01

    ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this…

  • CVE-2023-51800MedFeb 29, 2024
    School Fees Management System Project
    School Fees Management System1.0
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the main_settings component in the phone, address, bank, acc_name, acc_number parameters, new_class and cname parameter,…

  • CVE-2024-27517MedFeb 29, 2024
    Shop Script
    Webasyst
    risk 0.35cvss 5.4epss 0.00

    Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions.

  • CVE-2024-26471MedFeb 29, 2024
    zhimengzhe
    iBarn
    risk 0.35cvss 5.4epss 0.00

    A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web browser of a victim via the search parameter in offer.php.

  • CVE-2024-25831MedFeb 29, 2024
    F-logic
    DataCube3
    risk 0.35cvss 5.4epss 0.01

    F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.

  • CVE-2024-1411MedFeb 29, 2024
    WordPress
    Powerpack Addons For Elementor
    risk 0.35cvss 6.4epss 0.00

    The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all versions up to, and including, 2.7.15 due to insufficient input sanitization and output escaping. This makes it possible for…

  • CVE-2024-1236MedFeb 29, 2024
    WordPress
    Essential Addons For Elementor
    risk 0.35cvss 6.4epss 0.00

    The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to…

  • CVE-2024-1172MedFeb 29, 2024
    WordPress
    Essential Addons For Elementor
    risk 0.35cvss 5.4epss 0.00

    The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion widget in all versions up to, and including, 5.9.8 due to insufficient input…