VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1368 of 2,429
  • CVE-2023-37308MedJul 7, 2023
    Zoho
    ManageEngine ADAudit Plus
    risk 0.35cvss 5.4epss 0.02

    Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.

  • CVE-2023-37136MedJul 6, 2023
    Eyoucms
    Eyoucms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37135MedJul 6, 2023
    Eyoucms
    Eyoucms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37134MedJul 6, 2023
    Eyoucms
    Eyoucms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37133MedJul 6, 2023
    Eyoucms
    Eyoucms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37132MedJul 6, 2023
    Eyoucms
    Eyoucms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37125MedJul 6, 2023
    Seacms
    Seacms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37124MedJul 6, 2023
    Seacms
    Seacms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37122MedJul 6, 2023
    Bagecms
    Bagecms
    risk 0.35cvss 5.4epss 0.00

    A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.

  • CVE-2023-36970MedJul 6, 2023
    Cmsmadesimple
    Cmsmadesimple
    risk 0.35cvss 5.4epss 0.01

    A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function.

  • CVE-2023-30322MedJul 6, 2023
    Payatu
    ChatEngine
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary code.

  • CVE-2023-27225MedJul 6, 2023
    User Registration \& Login And User Management System With Admin Panel Project
    User Registration \& Login And User Management System With Admin Panel
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability in User Registration & Login and User Management System with Admin Panel v3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the first and last name field.

  • CVE-2023-36223MedJul 3, 2023
    mlogclub
    bbs-go
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.

  • CVE-2023-36222MedJul 3, 2023
    mlogclub
    bbs-go
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.

  • CVE-2020-22152MedJul 3, 2023
    Daylight Studio
    FuelCMS
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.

  • CVE-2023-37307MedJun 30, 2023
    Misp
    Misp
    risk 0.35cvss 5.4epss 0.01

    In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.

  • CVE-2023-37304MedJun 30, 2023
    MediaWiki
    Mediawiki
    risk 0.35cvss 5.4epss 0.01

    An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.

  • CVE-2023-32607MedJun 30, 2023
    Pleasanter
    Pleasanter
    risk 0.35cvss 5.4epss 0.01

    Stored cross-site scripting vulnerability in Pleasanter (Community Edition and Enterprise Edition) 1.3.39.2 and earlier versions allows a remote authenticated attacker to inject an arbitrary script.

  • CVE-2023-36146MedJun 30, 2023
    Multilaser
    Re170 Firmware
    risk 0.35cvss 5.4epss 0.00

    A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.

  • CVE-2023-36488MedJun 29, 2023
    Ilias
    Ilias
    risk 0.35cvss 5.4epss 0.00

    ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to stored Cross Site Scripting (XSS).