VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1410 of 2,429
  • CVE-2022-33113MedJun 23, 2022
    Jflyfox
    Jfinal CMS
    risk 0.35cvss 5.4epss 0.01

    Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.

  • CVE-2021-46824MedJun 23, 2022
    Sourcecodester
    School File Management System
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Lastname parameter to the Update Account form in student_profile.php.

  • CVE-2021-41432MedJun 23, 2022
    Flatpress
    Flatpress
    risk 0.35cvss 5.4epss 0.02

    A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.

  • CVE-2022-23057MedJun 22, 2022
    Frappe
    Erpnext
    risk 0.35cvss 5.4epss 0.01

    In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.

  • CVE-2022-25585MedJun 21, 2022
    Unioncms
    Unioncms
    risk 0.35cvss 5.4epss 0.00

    Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.

  • CVE-2022-31303MedJun 21, 2022
    Maccms
    Maccms
    risk 0.35cvss 5.4epss 0.00

    maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.

  • CVE-2022-31302MedJun 21, 2022
    Maccms
    Maccms
    risk 0.35cvss 5.4epss 0.00

    maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.

  • CVE-2022-2113MedJun 17, 2022
    GitHub
    inventree/inventree
    risk 0.35cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.

  • CVE-2022-30326MedJun 16, 2022
    Trendnet
    TEW-831DR
    risk 0.35cvss 5.4epss 0.01

    An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of the web interface.

  • CVE-2021-36609MedJun 16, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.

  • CVE-2021-36608MedJun 16, 2022
    webTareas
    webTareas
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.

  • CVE-2022-31301MedJun 16, 2022
    Haraj
    Haraj
    risk 0.35cvss 5.4epss 0.01

    Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.

  • CVE-2022-31298MedJun 16, 2022
    Haraj
    Haraj
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

  • CVE-2021-41420MedJun 16, 2022
    MaianAffiliate
    MaianAffiliate
    risk 0.35cvss 5.4epss 0.01

    A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel.

  • CVE-2022-31914MedJun 16, 2022
    Phpgurukul
    Zoo Management System
    risk 0.35cvss 5.4epss 0.01

    Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.

  • CVE-2022-31300MedJun 16, 2022
    Haraj
    DM Section
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

  • CVE-2022-30533MedJun 16, 2022
    Webnus
    Modern Events Calendar Lite
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors.

  • CVE-2022-32280MedJun 15, 2022
    Xakuro
    Xo Slider
    risk 0.35cvss 5.4epss 0.01

    Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress.

  • CVE-2022-28612MedJun 15, 2022
    WordPress
    Custom Popup Builder
    risk 0.35cvss 5.4epss 0.01

    Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.

  • CVE-2022-24127MedJun 15, 2022
    REDCap
    REDCap
    risk 0.35cvss 5.4epss 0.01

    A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an…