CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1392 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-28703 | Med | 0.35 | 5.4 | 0.01 | Dec 15, 2022 | A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger… | ||
| CVE-2020-9419 | Med | 0.35 | 5.4 | 0.01 | Dec 14, 2022 | Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard. | ||
| CVE-2022-42141 | Med | 0.35 | 5.4 | 0.01 | Dec 14, 2022 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter. | ||
| CVE-2022-46906 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS. | ||
| CVE-2022-46904 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Self-XSS. | ||
| CVE-2022-46903 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS. | ||
| CVE-2022-45970 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board. | ||
| CVE-2022-46684 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability. | ||
| CVE-2022-45758 | Med | 0.35 | 5.4 | 0.00 | Dec 12, 2022 | SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister. | ||
| CVE-2022-34297 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2022 | Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. | ||
| CVE-2022-4336 | Med | 0.35 | 5.4 | 0.00 | Dec 9, 2022 | In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature. | ||
| CVE-2022-25629 | Med | 0.35 | 5.4 | 0.00 | Dec 9, 2022 | An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column). | ||
| CVE-2022-41947 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2022 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick… | ||
| CVE-2022-44361 | Med | 0.35 | 5.4 | 0.00 | Dec 7, 2022 | An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php. | ||
| CVE-2022-41735 | Med | 0.35 | 5.4 | 0.00 | Dec 7, 2022 | IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially… | ||
| CVE-2022-45217 | Med | 0.35 | 5.4 | 0.01 | Dec 7, 2022 | A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Level parameter under the Add New System User module. | ||
| CVE-2022-45916 | Med | 0.35 | 5.4 | 0.01 | Dec 7, 2022 | ILIAS before 7.16 allows XSS. | ||
| CVE-2022-43706 | Med | 0.35 | 5.4 | 0.00 | Dec 5, 2022 | Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users. | ||
| CVE-2021-34181 | Med | 0.35 | 5.4 | 0.00 | Dec 5, 2022 | Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml. | ||
| CVE-2022-43097 | Med | 0.35 | 5.4 | 0.01 | Dec 5, 2022 | Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & login pages. |
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger…
- risk 0.35cvss 5.4epss 0.01
Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard.
- risk 0.35cvss 5.4epss 0.01
Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter.
- risk 0.35cvss 5.4epss 0.00
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS.
- risk 0.35cvss 5.4epss 0.00
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Self-XSS.
- risk 0.35cvss 5.4epss 0.00
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS.
- risk 0.35cvss 5.4epss 0.00
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
- risk 0.35cvss 5.4epss 0.00
Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.00
SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.
- risk 0.35cvss 5.4epss 0.01
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
- risk 0.35cvss 5.4epss 0.00
In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature.
- risk 0.35cvss 5.4epss 0.00
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column).
- risk 0.35cvss 5.4epss 0.00
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick…
- risk 0.35cvss 5.4epss 0.00
An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
- risk 0.35cvss 5.4epss 0.00
IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Level parameter under the Add New System User module.
- risk 0.35cvss 5.4epss 0.01
ILIAS before 7.16 allows XSS.
- risk 0.35cvss 5.4epss 0.00
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.
- risk 0.35cvss 5.4epss 0.01
Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & login pages.