VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1352 of 2,429
  • CVE-2023-47446MedNov 15, 2023
    Phpgurukul
    Pre School Enrollment System
    risk 0.35cvss 5.4epss 0.00

    Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.

  • CVE-2023-47309MedNov 15, 2023
    Nukium
    Gls
    risk 0.35cvss 5.4epss 0.00

    Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile.

  • CVE-2023-46580MedNov 14, 2023
    Code Projects
    Inventory Management
    risk 0.35cvss 5.4epss 0.01

    Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.

  • CVE-2023-46099MedNov 14, 2023
    Siemens Foundation
    PCS neo
    risk 0.35cvss 5.4epss 0.00

    A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with high privileges to inject Javascript code into the…

  • CVE-2023-45879MedNov 14, 2023
    Gibbon
    Gibbon
    risk 0.35cvss 5.4epss 0.00

    GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.

  • CVE-2023-48068MedNov 13, 2023
    Dedecms
    Dedecms
    risk 0.35cvss 5.4epss 0.00

    DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.

  • CVE-2023-4775MedNov 13, 2023
    WordPress
    Advanced Iframe
    risk 0.35cvss 6.4epss 0.01

    The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-5544MedNov 9, 2023
    Fedoraproject
    Fedora
    risk 0.35cvss 6.5epss 0.01

    Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

  • CVE-2023-37790MedNov 9, 2023
    Jaspersoft
    Clarity PPM
    risk 0.35cvss 5.4epss 0.00

    Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function.

  • CVE-2023-37533MedNov 9, 2023
    HCLTech
    Connections
    risk 0.35cvss 5.4epss 0.00

    HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow…

  • CVE-2023-46483MedNov 8, 2023
    TimeTec
    AWDMS
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of the New Zone function.

  • CVE-2023-46744MedNov 7, 2023
    Squidex
    Squidex
    risk 0.35cvss 5.4epss 0.01

    Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks through uploaded SVG…

  • CVE-2023-28499MedNov 7, 2023
    WordPress
    Slide Anything
    risk 0.35cvss 5.4epss 0.00

    Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 versions.

  • CVE-2023-5703MedNov 7, 2023
    Giftup
    Gift Up Gift Cards For Wordpress And Woocommerce
    risk 0.35cvss 6.4epss 0.01

    The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2023-5660MedNov 7, 2023
    WordPress
    SendPress Newsletters
    risk 0.35cvss 6.4epss 0.01

    The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…

  • CVE-2023-5659MedNov 7, 2023
    WordPress
    Interact: Embed A Quiz On Your Site
    risk 0.35cvss 6.4epss 0.01

    The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied…

  • CVE-2023-5577MedNov 7, 2023
    Bitly
    Bitly
    risk 0.35cvss 6.4epss 0.01

    The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

  • CVE-2023-4888MedNov 7, 2023
    WordPress
    Simple Like Page Plugin
    risk 0.35cvss 6.4epss 0.01

    The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…

  • CVE-2023-4842MedNov 7, 2023
    WordPress
    Social Warfare
    risk 0.35cvss 6.4epss 0.01

    The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

  • CVE-2023-5076MedNov 7, 2023
    Ziteboard
    Ziteboard
    risk 0.35cvss 6.4epss 0.00

    The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…