VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1386 of 2,429
  • CVE-2021-37379MedFeb 3, 2023
    Teradek, Llc
    Sphere
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any…

  • CVE-2021-37378MedFeb 3, 2023
    Teradke
    Cube Pro Firmware
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not…

  • CVE-2021-37377MedFeb 3, 2023
    Teradek, Llc
    Brik Firmware
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving…

  • CVE-2021-37376MedFeb 3, 2023
    Teradek, Llc
    Bond Pro Firmware
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and…

  • CVE-2021-37375MedFeb 3, 2023
    Teradek, Llc
    Vidiu Mini Firmware
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not…

  • CVE-2021-37374MedFeb 3, 2023
    Teradek, Llc
    Clip
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be receiving any firmware…

  • CVE-2021-37373MedFeb 3, 2023
    Teradek, Llc
    Slice
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. NOTE: Vedor states the product has reached End of Life and will not be…

  • CVE-2021-36712MedFeb 3, 2023
    Yzmcms
    Yzmcms
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.

  • CVE-2021-36545MedFeb 3, 2023
    tpcms
    tpcms
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page.

  • CVE-2021-36538MedFeb 3, 2023
    Gurock
    Testrail
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports.

  • CVE-2022-48140MedFeb 2, 2023
    Dedecms
    Dedecms
    risk 0.35cvss 5.4epss 0.00

    DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.

  • CVE-2022-47983MedFeb 1, 2023
    IBM
    Infosphere Information Server
    risk 0.35cvss 5.4epss 0.00

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2022-4898MedJan 31, 2023
    Octopus
    Server
    risk 0.35cvss 5.4epss 0.00

    In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different…

  • CVE-2023-0097MedJan 30, 2023
    WordPress
    Post Grid, Post Carousel, & List Category Posts
    risk 0.35cvss 5.4epss 0.00

    The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform…

  • CVE-2022-4837MedJan 30, 2023
    WordPress
    CPO Companion
    risk 0.35cvss 5.4epss 0.01

    The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used…

  • CVE-2022-4793MedJan 30, 2023
    Solwininfotech
    Blog Designer
    risk 0.35cvss 5.4epss 0.01

    The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

  • CVE-2022-4787MedJan 30, 2023
    Themify
    Shortcodes
    risk 0.35cvss 5.4epss 0.00

    Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

  • CVE-2022-4765MedJan 30, 2023
    WordPress
    Portfolio For Elementor
    risk 0.35cvss 5.4epss 0.01

    The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could…

  • CVE-2022-4749MedJan 30, 2023
    WordPress
    Posts List Designer by Category
    risk 0.35cvss 5.4epss 0.00

    The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which…

  • CVE-2022-4699MedJan 30, 2023
    WordPress
    MediaElement.js
    risk 0.35cvss 5.4epss 0.01

    The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used…