CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1394 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-42100 | Med | 0.35 | 5.4 | 0.01 | Nov 29, 2022 | KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input reply-form. | ||
| CVE-2022-42099 | Med | 0.35 | 5.4 | 0.01 | Nov 29, 2022 | KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input. | ||
| CVE-2022-41676 | Med | 0.35 | 5.4 | 0.00 | Nov 29, 2022 | Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the… | ||
| CVE-2022-44284 | Med | 0.35 | 5.4 | 0.01 | Nov 28, 2022 | Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-45040 | Med | 0.35 | 5.4 | 0.00 | Nov 25, 2022 | A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field. | ||
| CVE-2022-45038 | Med | 0.35 | 5.4 | 0.01 | Nov 25, 2022 | A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. | ||
| CVE-2022-45037 | Med | 0.35 | 5.4 | 0.01 | Nov 25, 2022 | A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. | ||
| CVE-2022-45036 | Med | 0.35 | 5.4 | 0.01 | Nov 25, 2022 | A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field. | ||
| CVE-2022-45280 | Med | 0.35 | 5.4 | 0.00 | Nov 23, 2022 | A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||
| CVE-2022-35501 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function. | ||
| CVE-2022-45472 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup. | ||
| CVE-2022-38147 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). | ||
| CVE-2022-37421 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/cms through 4.11.0 allows XSS. | ||
| CVE-2022-38145 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view. | ||
| CVE-2022-37430 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). | ||
| CVE-2022-37429 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. | ||
| CVE-2022-35500 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality. | ||
| CVE-2022-38724 | Med | 0.35 | 5.4 | 0.01 | Nov 23, 2022 | Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. | ||
| CVE-2022-45363 | Med | 0.35 | 5.4 | 0.00 | Nov 22, 2022 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress. | ||
| CVE-2022-43117 | Med | 0.35 | 5.4 | 0.01 | Nov 21, 2022 | Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Name, Username, Description and Site Feature parameters. |
- risk 0.35cvss 5.4epss 0.01
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input reply-form.
- risk 0.35cvss 5.4epss 0.01
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input.
- risk 0.35cvss 5.4epss 0.00
Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the…
- risk 0.35cvss 5.4epss 0.01
Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field.
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- risk 0.35cvss 5.4epss 0.01
Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function.
- risk 0.35cvss 5.4epss 0.01
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/cms through 4.11.0 allows XSS.
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.
- risk 0.35cvss 5.4epss 0.01
Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.
- risk 0.35cvss 5.4epss 0.00
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress.
- risk 0.35cvss 5.4epss 0.01
Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Name, Username, Description and Site Feature parameters.