VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1402 of 2,429
  • CVE-2022-36107MedSep 13, 2022
    TYPO3
    Typo3
    risk 0.35cvss 6.5epss 0.01

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid…

  • CVE-2022-35294MedSep 13, 2022
    SAP
    NetWeaver Application Server for ABAP
    risk 0.35cvss 5.4epss 0.01

    An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure…

  • CVE-2022-36254MedSep 12, 2022
    Tramyardg
    Hotel Management System
    risk 0.35cvss 5.4epss 0.01

    Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".

  • CVE-2022-37796MedSep 12, 2022
    Oretnom23
    Simple Online Book Store System
    risk 0.35cvss 5.4epss 0.01

    In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable to Cross Site Scripting(XSS).

  • CVE-2022-38639MedSep 9, 2022
    Inkdrop
    Markdown Nice
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.

  • CVE-2022-40191MedSep 9, 2022
    WordPress
    Contact Form By Mega Forms
    risk 0.35cvss 5.4epss 0.01

    Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

  • CVE-2022-38256MedSep 8, 2022
    TastyIgniter
    TastyIgniter
    risk 0.35cvss 5.4epss 0.01

    TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2022-37253MedSep 6, 2022
    Crime Reporting System
    Crime Reporting System
    risk 0.35cvss 5.4epss 0.01

    Persistent cross-site scripting (XSS) in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulation of an unsanitized POST parameter

  • CVE-2022-36057MedSep 6, 2022
    Discourse (software)
    Discourse Chat
    risk 0.35cvss 5.4epss 0.01

    Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a…

  • CVE-2022-31792MedSep 6, 2022
    WatchGuard
    Fireware
    risk 0.35cvss 5.4epss 0.01

    A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed…

  • CVE-2022-26114MedSep 6, 2022
    Fortinet
    Fortimail
    risk 0.35cvss 5.4epss 0.00

    An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.

  • CVE-2022-3127MedSep 5, 2022
    Jgraph
    Drawio
    risk 0.35cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

  • CVE-2022-36639MedSep 2, 2022
    Garage Management System Project
    Garage Management System
    risk 0.35cvss 5.4epss 0.01

    A stored cross-site scripting (XSS) vulnerability in /client.php of Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.

  • CVE-2022-25370MedSep 2, 2022
    Apache
    Ofbiz
    risk 0.35cvss 5.4epss 0.03

    Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an…

  • CVE-2022-36637MedSep 2, 2022
    Garage Management System Project
    Garage Management System
    risk 0.35cvss 5.4epss 0.01

    Garage Management System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the brand_name parameter at /brand.php.

  • CVE-2022-36355MedSep 1, 2022
    WordPress
    Easy Org Chart
    risk 0.35cvss 5.4epss 0.01

    Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress.

  • CVE-2022-38790MedSep 1, 2022
    Weave
    GitOps Enterprise
    risk 0.35cvss 5.4epss 0.01

    Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise…

  • CVE-2022-33935MedAug 30, 2022
    Dell
    Emc Data Protection Advisor
    risk 0.35cvss 5.4epss 0.00

    Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user…

  • CVE-2022-25646MedAug 30, 2022
    X Data Spreadsheet Project
    X Data Spreadsheet
    risk 0.35cvss 5.4epss 0.01

    All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.

  • CVE-2021-38934MedAug 29, 2022
    IBM
    Engineering Test Management
    risk 0.35cvss 5.4epss 0.00

    IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…