CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1398 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-42200 | Med | 0.35 | 5.4 | 0.01 | Oct 20, 2022 | Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List. | ||
| CVE-2021-33231 | Med | 0.35 | 5.4 | 0.01 | Oct 20, 2022 | Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field. | ||
| CVE-2022-43425 | Med | 0.35 | 5.4 | 0.01 | Oct 19, 2022 | Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure… | ||
| CVE-2022-43185 | Med | 0.35 | 5.4 | 0.01 | Oct 19, 2022 | A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter. | ||
| CVE-2022-38901 | Med | 0.35 | 5.4 | 0.01 | Oct 19, 2022 | A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file. | ||
| CVE-2022-3339 | Med | 0.35 | 5.4 | 0.01 | Oct 18, 2022 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.… | ||
| CVE-2022-41431 | Med | 0.35 | 5.4 | 0.01 | Oct 17, 2022 | xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field. | ||
| CVE-2022-41139 | Med | 0.35 | 5.4 | 0.01 | Oct 17, 2022 | MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents. | ||
| CVE-2022-41472 | Med | 0.35 | 5.4 | 0.00 | Oct 17, 2022 | 74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field. | ||
| CVE-2022-42069 | Med | 0.35 | 5.4 | 0.00 | Oct 14, 2022 | Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability. | ||
| CVE-2022-3506 | Med | 0.35 | 5.4 | 0.02 | Oct 14, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3. | ||
| CVE-2022-35612 | Med | 0.35 | 5.4 | 0.01 | Oct 13, 2022 | A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field. | ||
| CVE-2022-35134 | Med | 0.35 | 5.4 | 0.01 | Oct 13, 2022 | Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability. | ||
| CVE-2022-34021 | Med | 0.35 | 5.4 | 0.01 | Oct 13, 2022 | Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields. | ||
| CVE-2022-38902 | Med | 0.35 | 5.4 | 0.01 | Oct 13, 2022 | A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic. | ||
| CVE-2022-41206 | Med | 0.35 | 5.4 | 0.01 | Oct 11, 2022 | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs when OLAP connections are created and edited in the Central Management Console. On successful exploitation, there could be… | ||
| CVE-2022-35297 | Med | 0.35 | 5.4 | 0.01 | Oct 11, 2022 | The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited… | ||
| CVE-2022-40047 | Med | 0.35 | 5.4 | 0.01 | Oct 11, 2022 | Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php. | ||
| CVE-2022-42236 | Med | 0.35 | 5.4 | 0.00 | Oct 11, 2022 | A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form. | ||
| CVE-2022-42235 | Med | 0.35 | 5.4 | 0.01 | Oct 11, 2022 | A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form. |
- risk 0.35cvss 5.4epss 0.01
Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbitrary code via the notes field.
- risk 0.35cvss 5.4epss 0.01
Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure…
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
- risk 0.35cvss 5.4epss 0.01
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.…
- risk 0.35cvss 5.4epss 0.01
xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
- risk 0.35cvss 5.4epss 0.01
MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.
- risk 0.35cvss 5.4epss 0.00
74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
- risk 0.35cvss 5.4epss 0.00
Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.02
Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
- risk 0.35cvss 5.4epss 0.01
Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.
- risk 0.35cvss 5.4epss 0.01
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
- risk 0.35cvss 5.4epss 0.01
SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs when OLAP connections are created and edited in the Central Management Console. On successful exploitation, there could be…
- risk 0.35cvss 5.4epss 0.01
The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited…
- risk 0.35cvss 5.4epss 0.01
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
- risk 0.35cvss 5.4epss 0.00
A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.
- risk 0.35cvss 5.4epss 0.01
A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form.