CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1419 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-28133 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2022 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers. | ||
| CVE-2022-23903 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2022 | A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent. | ||
| CVE-2022-24957 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2022 | DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or… | ||
| CVE-2021-45866 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2022 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in index.php. | ||
| CVE-2022-0397 | Med | 0.35 | 5.4 | 0.01 | Mar 28, 2022 | The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting | ||
| CVE-2021-44211 | Med | 0.35 | 5.4 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. | ||
| CVE-2022-26197 | Med | 0.35 | 5.4 | 0.01 | Mar 25, 2022 | Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table. | ||
| CVE-2022-24643 | Med | 0.35 | 5.4 | 0.01 | Mar 25, 2022 | A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0. | ||
| CVE-2022-25582 | Med | 0.35 | 5.4 | 0.01 | Mar 25, 2022 | A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field. | ||
| CVE-2021-39491 | Med | 0.35 | 5.4 | 0.00 | Mar 24, 2022 | A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . . | ||
| CVE-2021-43659 | Med | 0.35 | 5.4 | 0.01 | Mar 24, 2022 | In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability. | ||
| CVE-2022-25609 | Med | 0.35 | 5.4 | 0.01 | Mar 23, 2022 | Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code. | ||
| CVE-2022-0857 | Med | 0.35 | 5.4 | 0.01 | Mar 23, 2022 | A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link.… | ||
| CVE-2022-23350 | Med | 0.35 | 5.4 | 0.01 | Mar 21, 2022 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability. | ||
| CVE-2022-0423 | Med | 0.35 | 5.4 | 0.01 | Mar 21, 2022 | The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d… | ||
| CVE-2022-26555 | Med | 0.35 | 5.4 | 0.00 | Mar 20, 2022 | A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the button name text box. | ||
| CVE-2022-26295 | Med | 0.35 | 5.4 | 0.01 | Mar 16, 2022 | A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field. | ||
| CVE-2021-23648 | Med | 0.35 | 5.4 | 0.01 | Mar 16, 2022 | The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function. | ||
| CVE-2021-33853 | — | Med | 0.35 | 5.4 | 0.01 | Mar 16, 2022 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS… | |
| CVE-2021-45787 | Med | 0.35 | 5.4 | 0.00 | Mar 16, 2022 | There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks. |
- risk 0.35cvss 5.4epss 0.01
Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
- risk 0.35cvss 5.4epss 0.01
A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.
- risk 0.35cvss 5.4epss 0.01
DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or…
- risk 0.35cvss 5.4epss 0.01
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in index.php.
- risk 0.35cvss 5.4epss 0.01
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- risk 0.35cvss 5.4epss 0.01
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
- risk 0.35cvss 5.4epss 0.01
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field.
- risk 0.35cvss 5.4epss 0.00
A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . .
- risk 0.35cvss 5.4epss 0.01
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
- risk 0.35cvss 5.4epss 0.01
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
- risk 0.35cvss 5.4epss 0.01
A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link.…
- risk 0.35cvss 5.4epss 0.01
BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d…
- risk 0.35cvss 5.4epss 0.00
A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the button name text box.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field.
- risk 0.35cvss 5.4epss 0.01
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS…
- risk 0.35cvss 5.4epss 0.00
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.