VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1393 of 2,429
  • CVE-2022-43499MedDec 5, 2022
    Shirasagi
    Shirasagi
    risk 0.35cvss 5.4epss 0.01

    Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

  • CVE-2022-44962MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.

  • CVE-2022-44961MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

  • CVE-2022-44960MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.

  • CVE-2022-44959MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

  • CVE-2022-44957MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.01

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

  • CVE-2022-44956MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

  • CVE-2022-44955MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field.

  • CVE-2022-44954MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking…

  • CVE-2022-44953MedDec 2, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking…

  • CVE-2022-44952MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text…

  • CVE-2022-44951MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

  • CVE-2022-44950MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

  • CVE-2022-44949MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

  • CVE-2022-44948MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected…

  • CVE-2022-44947MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted…

  • CVE-2022-44946MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload…

  • CVE-2022-44944MedDec 2, 2022
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted…

  • CVE-2022-45215MedDec 2, 2022
    Book Store Management System Project
    Book Store Management System
    risk 0.35cvss 5.4epss 0.00

    A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the Add New System User module.

  • CVE-2022-38801MedNov 30, 2022
    Zkteco
    BioTime
    risk 0.35cvss 5.4epss 0.00

    In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.