VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1421 of 2,429
  • CVE-2022-23051MedMar 3, 2022
    PeteReport
    PeteReport
    risk 0.35cvss 5.4epss 0.01

    PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parameter.

  • CVE-2022-25138MedMar 3, 2022
    Axelor
    Open Suite
    risk 0.35cvss 5.4epss 0.01

    Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.

  • CVE-2022-24563MedMar 3, 2022
    Genixcms
    Genixcms
    risk 0.35cvss 5.4epss 0.01

    In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

  • CVE-2022-22944MedMar 2, 2022
    VMware
    Workspace One Boxer
    risk 0.35cvss 5.4epss 0.00

    VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's…

  • CVE-2022-25022MedMar 1, 2022
    Danpros
    Htmly
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.

  • CVE-2022-25020MedMar 1, 2022
    Pluxml
    Pluxml
    risk 0.35cvss 5.4epss 0.01

    A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.

  • CVE-2022-26332MedMar 1, 2022
    Cipi
    Cipi
    risk 0.35cvss 5.4epss 0.01

    Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.

  • CVE-2022-25413MedFeb 28, 2022
    Maxsite
    CMS
    risk 0.35cvss 5.4epss 0.00

    Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3.

  • CVE-2022-25410MedFeb 28, 2022
    Maxsite
    CMS
    risk 0.35cvss 5.4epss 0.00

    Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files.

  • CVE-2022-25409MedFeb 28, 2022
    Hospital Management System
    Hospital Management System
    risk 0.35cvss 5.4epss 0.00

    Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php.

  • CVE-2022-25408MedFeb 28, 2022
    Hospital Management System
    Hospital Management System
    risk 0.35cvss 5.4epss 0.00

    Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php.

  • CVE-2022-25407MedFeb 28, 2022
    Hospital Management System
    Hospital Management System
    risk 0.35cvss 5.4epss 0.00

    Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.

  • CVE-2022-25015MedFeb 28, 2022
    ICE Hrm
    ICE Hrm
    risk 0.35cvss 5.4epss 0.01

    A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.

  • CVE-2021-24971MedFeb 28, 2022
    WordPress
    WP Responsive Menu
    risk 0.35cvss 5.4epss 0.01

    The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's…

  • CVE-2021-24933MedFeb 28, 2022
    WordPress
    Dynamic Widgets
    risk 0.35cvss 5.4epss 0.01

    The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue

  • CVE-2021-24901MedFeb 28, 2022
    WordPress
    Security Audit WordPress plugin
    risk 0.35cvss 4.8epss 0.05

    The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

  • CVE-2022-26146MedFeb 26, 2022
    Tricentis
    qTest
    risk 0.35cvss 5.4epss 0.00

    Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.

  • CVE-2022-24347MedFeb 25, 2022
    Jetbrains
    Youtrack
    risk 0.35cvss 5.4epss 0.01

    JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.

  • CVE-2022-24344MedFeb 25, 2022
    Jetbrains
    Youtrack
    risk 0.35cvss 5.4epss 0.01

    JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.

  • CVE-2022-24339MedFeb 25, 2022
    Jetbrains
    Teamcity
    risk 0.35cvss 5.4epss 0.00

    JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.