CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1366 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-26445 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2023 | Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the… | ||
| CVE-2023-36121 | Med | 0.35 | 5.4 | 0.01 | Aug 2, 2023 | Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project. | ||
| CVE-2023-36118 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2023 | Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter. | ||
| CVE-2023-36211 | Med | 0.35 | 5.4 | 0.00 | Aug 1, 2023 | The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel. | ||
| CVE-2023-23548 | Med | 0.35 | 5.4 | 0.00 | Aug 1, 2023 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | ||
| CVE-2020-36763 | Med | 0.35 | 5.4 | 0.00 | Jul 31, 2023 | Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post. | ||
| CVE-2023-38311 | Med | 0.35 | 5.4 | 0.01 | Jul 31, 2023 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the… | ||
| CVE-2023-38310 | Med | 0.35 | 5.4 | 0.01 | Jul 31, 2023 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log… | ||
| CVE-2023-38307 | Med | 0.35 | 5.4 | 0.00 | Jul 31, 2023 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name. | ||
| CVE-2023-38304 | Med | 0.35 | 5.4 | 0.00 | Jul 31, 2023 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group. | ||
| CVE-2023-38303 | Med | 0.35 | 5.4 | 0.01 | Jul 31, 2023 | An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter. | ||
| CVE-2023-35792 | Med | 0.35 | 5.4 | 0.00 | Jul 31, 2023 | Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). | ||
| CVE-2023-22595 | Med | 0.35 | 5.4 | 0.00 | Jul 31, 2023 | IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2023-38331 | Med | 0.35 | 5.4 | 0.02 | Jul 28, 2023 | Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module. | ||
| CVE-2023-37692 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2023 | An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file. | ||
| CVE-2023-31466 | Med | 0.35 | 5.4 | 0.00 | Jul 26, 2023 | An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code. | ||
| CVE-2023-3946 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2023 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.… | ||
| CVE-2023-37257 | Med | 0.35 | 5.4 | 0.00 | Jul 25, 2023 | DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds. | ||
| CVE-2023-36806 | Med | 0.35 | 6.5 | 0.01 | Jul 25, 2023 | Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element… | ||
| CVE-2023-35929 | Med | 0.35 | 5.4 | 0.00 | Jul 25, 2023 | Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible… |
- risk 0.35cvss 5.4epss 0.01
Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the…
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.
- risk 0.35cvss 5.4epss 0.00
The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.
- risk 0.35cvss 5.4epss 0.00
Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or editing a post.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log…
- risk 0.35cvss 5.4epss 0.00
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.
- risk 0.35cvss 5.4epss 0.00
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.
- risk 0.35cvss 5.4epss 0.00
Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).
- risk 0.35cvss 5.4epss 0.00
IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.02
Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
- risk 0.35cvss 5.4epss 0.01
An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.
- risk 0.35cvss 5.4epss 0.00
An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code.
- risk 0.35cvss 5.4epss 0.01
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.…
- risk 0.35cvss 5.4epss 0.00
DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds.
- risk 0.35cvss 6.5epss 0.01
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element…
- risk 0.35cvss 5.4epss 0.00
Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible…