CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1427 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24828 | Med | 0.35 | 5.4 | 0.01 | Jan 3, 2022 | The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | ||
| CVE-2021-24680 | Med | 0.35 | 5.4 | 0.01 | Jan 3, 2022 | The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the… | ||
| CVE-2022-22293 | Med | 0.35 | 5.4 | 0.01 | Jan 2, 2022 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. | ||
| CVE-2021-25993 | Med | 0.35 | 5.4 | 0.01 | Dec 29, 2021 | In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s… | ||
| CVE-2021-4175 | Med | 0.35 | 5.4 | 0.01 | Dec 29, 2021 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-38680 | Med | 0.35 | 5.3 | 0.01 | Dec 29, 2021 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo… | ||
| CVE-2021-25990 | Med | 0.35 | 5.4 | 0.01 | Dec 29, 2021 | In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe. | ||
| CVE-2021-25989 | Med | 0.35 | 5.4 | 0.01 | Dec 29, 2021 | In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them. | ||
| CVE-2021-25988 | Med | 0.35 | 5.4 | 0.01 | Dec 29, 2021 | In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin. | ||
| CVE-2021-4179 | Med | 0.35 | 5.4 | 0.00 | Dec 28, 2021 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-45906 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2021 | OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen. | ||
| CVE-2021-45905 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2021 | OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen. | ||
| CVE-2021-45904 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2021 | OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen. | ||
| CVE-2020-20946 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2021 | Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add. | ||
| CVE-2021-24988 | Med | 0.35 | 5.4 | 0.00 | Dec 27, 2021 | The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks,… | ||
| CVE-2021-24969 | Med | 0.35 | 5.4 | 0.01 | Dec 27, 2021 | The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any… | ||
| CVE-2020-20600 | Med | 0.35 | 5.4 | 0.01 | Dec 22, 2021 | MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. | ||
| CVE-2021-38966 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2021 | IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2021-38893 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2021 | IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality… | ||
| CVE-2020-19770 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2021 | A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie. |
- risk 0.35cvss 5.4epss 0.01
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- risk 0.35cvss 5.4epss 0.01
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the…
- risk 0.35cvss 5.4epss 0.01
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
- risk 0.35cvss 5.4epss 0.01
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s…
- risk 0.35cvss 5.4epss 0.01
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.35cvss 5.3epss 0.01
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo…
- risk 0.35cvss 5.4epss 0.01
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
- risk 0.35cvss 5.4epss 0.01
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
- risk 0.35cvss 5.4epss 0.01
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.
- risk 0.35cvss 5.4epss 0.00
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.35cvss 5.4epss 0.01
OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.
- risk 0.35cvss 5.4epss 0.01
OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.
- risk 0.35cvss 5.4epss 0.01
OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.
- risk 0.35cvss 5.4epss 0.01
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
- risk 0.35cvss 5.4epss 0.00
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks,…
- risk 0.35cvss 5.4epss 0.01
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any…
- risk 0.35cvss 5.4epss 0.01
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie.