CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1412 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-38221 | Med | 0.35 | 5.4 | 0.01 | Jun 2, 2022 | bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS. | ||
| CVE-2022-29734 | Med | 0.35 | 5.4 | 0.00 | Jun 2, 2022 | A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter. | ||
| CVE-2022-29648 | Med | 0.35 | 5.4 | 0.01 | Jun 2, 2022 | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. | ||
| CVE-2022-29628 | Med | 0.35 | 5.4 | 0.01 | Jun 2, 2022 | A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a crafted payload injected into the Page parameter. | ||
| CVE-2022-26976 | Med | 0.35 | 5.4 | 0.00 | Jun 2, 2022 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS. | ||
| CVE-2022-1562 | Med | 0.35 | 5.4 | 0.01 | May 30, 2022 | The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads | ||
| CVE-2022-20802 | Med | 0.35 | 5.4 | 0.01 | May 27, 2022 | A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input… | ||
| CVE-2022-1909 | Med | 0.35 | 5.4 | 0.01 | May 27, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200. | ||
| CVE-2022-30494 | Med | 0.35 | 5.4 | 0.01 | May 26, 2022 | In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs. | ||
| CVE-2022-29091 | Med | 0.35 | 5.3 | 0.01 | May 26, 2022 | Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or… | ||
| CVE-2022-30842 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname. | ||
| CVE-2022-30837 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name. | ||
| CVE-2022-30464 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response. | ||
| CVE-2022-30462 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Water-billing-management-system v1.0 is affected by: Cross Site Scripting (XSS) via /wbms/classes/Users.php?f=save, firstname. | ||
| CVE-2022-30460 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname. | ||
| CVE-2022-30458 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_product, name. | ||
| CVE-2022-30456 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_court_rental. | ||
| CVE-2021-42656 | Med | 0.35 | 5.4 | 0.01 | May 24, 2022 | SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability. | ||
| CVE-2022-30015 | Med | 0.35 | 5.4 | 0.01 | May 23, 2022 | In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss. | ||
| CVE-2021-42233 | Med | 0.35 | 5.4 | 0.01 | May 23, 2022 | The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur. |
- risk 0.35cvss 5.4epss 0.01
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a crafted payload injected into the Page parameter.
- risk 0.35cvss 5.4epss 0.00
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.
- risk 0.35cvss 5.4epss 0.01
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input…
- risk 0.35cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
- risk 0.35cvss 5.4epss 0.01
In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs.
- risk 0.35cvss 5.3epss 0.01
Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or…
- risk 0.35cvss 5.4epss 0.01
Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname.
- risk 0.35cvss 5.4epss 0.01
Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name.
- risk 0.35cvss 5.4epss 0.01
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.
- risk 0.35cvss 5.4epss 0.01
Water-billing-management-system v1.0 is affected by: Cross Site Scripting (XSS) via /wbms/classes/Users.php?f=save, firstname.
- risk 0.35cvss 5.4epss 0.01
Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname.
- risk 0.35cvss 5.4epss 0.01
Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_product, name.
- risk 0.35cvss 5.4epss 0.01
Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_court_rental.
- risk 0.35cvss 5.4epss 0.01
SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like Full Username, etc .This causes stored xss.
- risk 0.35cvss 5.4epss 0.01
The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.