CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1367 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-3384 | Med | 0.35 | 5.4 | 0.00 | Jul 24, 2023 | A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish… | ||
| CVE-2022-28867 | Med | 0.35 | 5.4 | 0.00 | Jul 24, 2023 | An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include JavaScript code, which is then stored and executed by a victim's web browser. The most common… | ||
| CVE-2022-28865 | Med | 0.35 | 5.4 | 0.00 | Jul 24, 2023 | An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for… | ||
| CVE-2023-28530 | Med | 0.35 | 5.4 | 0.01 | Jul 22, 2023 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of… | ||
| CVE-2023-25836 | Med | 0.35 | 5.4 | 0.00 | Jul 21, 2023 | There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The… | ||
| CVE-2021-45094 | Med | 0.35 | 5.4 | 0.01 | Jul 20, 2023 | Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. | ||
| CVE-2023-2433 | Med | 0.35 | 6.4 | 0.01 | Jul 18, 2023 | The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary… | ||
| CVE-2023-38350 | — | Med | 0.35 | 5.4 | 0.01 | Jul 15, 2023 | PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26. | |
| CVE-2023-37223 | Med | 0.35 | 5.4 | 0.01 | Jul 14, 2023 | Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script. | ||
| CVE-2023-24896 | Med | 0.35 | 5.4 | 0.01 | Jul 14, 2023 | Dynamics 365 Finance Spoofing Vulnerability | ||
| CVE-2023-31705 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter. | ||
| CVE-2023-29455 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of… | ||
| CVE-2023-29454 | Med | 0.35 | 5.4 | 0.01 | Jul 13, 2023 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the… | ||
| CVE-2023-3319 | Med | 0.35 | 5.4 | 0.00 | Jul 13, 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS. This issue affects PlatPlay DS: before 3.14. | ||
| CVE-2023-37658 | Med | 0.35 | 5.4 | 0.00 | Jul 11, 2023 | fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at /server/fast.py -> ApiUploadHandler.post causes stored XSS | ||
| CVE-2023-37657 | Med | 0.35 | 5.4 | 0.00 | Jul 11, 2023 | TwoNav v2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-30963 | Med | 0.35 | 5.4 | 0.00 | Jul 10, 2023 | A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry… | ||
| CVE-2023-36375 | Med | 0.35 | 5.4 | 0.01 | Jul 10, 2023 | Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details… | ||
| CVE-2023-20133 | Med | 0.35 | 5.4 | 0.01 | Jul 7, 2023 | A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied… | ||
| CVE-2023-29998 | — | Med | 0.35 | 5.4 | 0.01 | Jul 7, 2023 | A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter. |
- risk 0.35cvss 5.4epss 0.00
A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish…
- risk 0.35cvss 5.4epss 0.00
An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include JavaScript code, which is then stored and executed by a victim's web browser. The most common…
- risk 0.35cvss 5.4epss 0.00
An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for…
- risk 0.35cvss 5.4epss 0.01
IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a victim's Web browser within the security context of…
- risk 0.35cvss 5.4epss 0.00
There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The…
- risk 0.35cvss 5.4epss 0.01
Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.
- risk 0.35cvss 6.4epss 0.01
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary…
- risk 0.35cvss 5.4epss 0.01
PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.
- risk 0.35cvss 5.4epss 0.01
Dynamics 365 Finance Spoofing Vulnerability
- risk 0.35cvss 5.4epss 0.01
A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter.
- risk 0.35cvss 5.4epss 0.01
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of…
- risk 0.35cvss 5.4epss 0.01
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the…
- risk 0.35cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS. This issue affects PlatPlay DS: before 3.14.
- risk 0.35cvss 5.4epss 0.00
fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at /server/fast.py -> ApiUploadHandler.post causes stored XSS
- risk 0.35cvss 5.4epss 0.00
TwoNav v2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS).
- risk 0.35cvss 5.4epss 0.00
A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry…
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied…
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter.