CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1348 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-48443 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2023 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within… | ||
| CVE-2023-48442 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2023 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s… | ||
| CVE-2023-48440 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2023 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s… | ||
| CVE-2023-47065 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2023 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within… | ||
| CVE-2023-47064 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2023 | Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s… | ||
| CVE-2023-5769 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized. | ||
| CVE-2023-50137 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. | ||
| CVE-2023-50102 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-50101 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. | ||
| CVE-2023-50100 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. | ||
| CVE-2023-50566 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter. | ||
| CVE-2023-50565 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||
| CVE-2023-48642 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2023 | Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access… | ||
| CVE-2023-48715 | Med | 0.35 | 5.4 | 0.01 | Dec 11, 2023 | Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on… | ||
| CVE-2023-50465 | Med | 0.35 | 5.4 | 0.01 | Dec 11, 2023 | A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user. | ||
| CVE-2023-28873 | Med | 0.35 | 5.4 | 0.00 | Dec 9, 2023 | An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. | ||
| CVE-2023-49487 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. | ||
| CVE-2023-49486 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. | ||
| CVE-2023-49485 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. | ||
| CVE-2023-49484 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department. |
- risk 0.35cvss 5.4epss 0.01
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within…
- risk 0.35cvss 5.4epss 0.01
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s…
- risk 0.35cvss 5.4epss 0.01
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s…
- risk 0.35cvss 5.4epss 0.01
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within…
- risk 0.35cvss 5.4epss 0.01
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s…
- risk 0.35cvss 5.4epss 0.00
A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross-site scripting on the webserver due to user input being improperly sanitized.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
- risk 0.35cvss 5.4epss 0.00
A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter.
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- risk 0.35cvss 5.4epss 0.00
Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access…
- risk 0.35cvss 5.4epss 0.01
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on…
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.
- risk 0.35cvss 5.4epss 0.00
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
- risk 0.35cvss 5.4epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department.