CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1395 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-38146 | Med | 0.35 | 5.4 | 0.01 | Nov 21, 2022 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). | ||
| CVE-2022-41788 | Med | 0.35 | 5.4 | 0.00 | Nov 18, 2022 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress. | ||
| CVE-2022-40698 | Med | 0.35 | 5.4 | 0.00 | Nov 18, 2022 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. | ||
| CVE-2021-37936 | Med | 0.35 | 5.4 | 0.01 | Nov 18, 2022 | It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML,… | ||
| CVE-2022-45375 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. | ||
| CVE-2021-36905 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress. | ||
| CVE-2022-38390 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2022-42954 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | Keyfactor EJBCA before 7.10.0 allows XSS. | ||
| CVE-2022-39834 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user. | ||
| CVE-2022-36432 | Med | 0.35 | 5.4 | 0.01 | Nov 17, 2022 | The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response. | ||
| CVE-2022-42960 | Med | 0.35 | 5.4 | 0.00 | Nov 17, 2022 | EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js. | ||
| CVE-2022-44073 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. | ||
| CVE-2022-44071 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. | ||
| CVE-2022-44070 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. | ||
| CVE-2022-44069 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. | ||
| CVE-2022-30768 | Med | 0.35 | 5.4 | 0.01 | Nov 15, 2022 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions… | ||
| CVE-2022-40753 | Med | 0.35 | 5.4 | 0.00 | Nov 15, 2022 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2022-45401 | Med | 0.35 | 5.4 | 0.01 | Nov 15, 2022 | Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | ||
| CVE-2022-40844 | Med | 0.35 | 5.4 | 0.01 | Nov 15, 2022 | In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications website filtering tab, specifically the URL body. | ||
| CVE-2022-44390 | Med | 0.35 | 5.4 | 0.00 | Nov 14, 2022 | A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field. |
- risk 0.35cvss 5.4epss 0.01
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).
- risk 0.35cvss 5.4epss 0.00
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.
- risk 0.35cvss 5.4epss 0.00
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
- risk 0.35cvss 5.4epss 0.01
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML,…
- risk 0.35cvss 5.4epss 0.00
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress.
- risk 0.35cvss 5.4epss 0.00
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
- risk 0.35cvss 5.4epss 0.00
Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.35cvss 5.4epss 0.00
Keyfactor EJBCA before 7.10.0 allows XSS.
- risk 0.35cvss 5.4epss 0.00
A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user.
- risk 0.35cvss 5.4epss 0.01
The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response.
- risk 0.35cvss 5.4epss 0.00
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.
- risk 0.35cvss 5.4epss 0.01
A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions…
- risk 0.35cvss 5.4epss 0.00
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- risk 0.35cvss 5.4epss 0.01
In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications website filtering tab, specifically the URL body.
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.