VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,564)

page 1442 of 2,429
  • CVE-2021-37794MedAug 31, 2021
    Filebrowser
    Filebrowser
    risk 0.35cvss 5.4epss 0.01

    A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger…

  • CVE-2020-19049MedAug 31, 2021
    MyBB
    Mybb
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.

  • CVE-2020-19048MedAug 31, 2021
    MyBB
    Mybb
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.

  • CVE-2020-19046MedAug 31, 2021
    S CMS
    S CMS
    risk 0.35cvss 5.4epss 0.01

    Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.

  • CVE-2021-34562MedAug 31, 2021
    Pepperl Fuchs
    WirelessHART-Gateway
    risk 0.35cvss 5.4epss 0.01

    In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.

  • CVE-2021-38144MedAug 31, 2021
    Formtools.org
    Form Tools
    risk 0.35cvss 5.4epss 0.01

    An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?form_id=1&view_id=1&submission_id=[XSS].

  • CVE-2021-22021MedAug 30, 2021
    VMware
    Vrealize Log Insight
    risk 0.35cvss 5.4epss 0.00

    VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim…

  • CVE-2020-18126MedAug 30, 2021
    Indexhibit
    indexhibit
    risk 0.35cvss 5.4epss 0.01

    Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.

  • CVE-2021-29743MedAug 30, 2021
    IBM
    Maximo Asset Management
    risk 0.35cvss 5.4epss 0.01

    IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2021-24667MedAug 30, 2021
    Simplygallery
    Simply Gallery Blocks With Lightbox
    risk 0.35cvss 5.4epss 0.01

    A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the…

  • CVE-2021-24665MedAug 30, 2021
    WordPress
    Wp Video Lightbox
    risk 0.35cvss 5.4epss 0.01

    The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks

  • CVE-2021-24593MedAug 30, 2021
    WordPress
    Business Hours Indicator
    risk 0.35cvss 5.4epss 0.01

    The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue

  • CVE-2021-24528MedAug 30, 2021
    WordPress
    FluentSMTP
    risk 0.35cvss 5.4epss 0.01

    The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS)…

  • CVE-2021-29744MedAug 27, 2021
    IBM
    Maximo Asset Management
    risk 0.35cvss 5.4epss 0.01

    IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

  • CVE-2020-18475MedAug 26, 2021
    HuCart
    HuCart
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed.

  • CVE-2020-18470MedAug 26, 2021
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to…

  • CVE-2020-18469MedAug 26, 2021
    Rukovoditel
    Rukovoditel
    risk 0.35cvss 5.4epss 0.01

    Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST…

  • CVE-2020-18468MedAug 26, 2021
    Qdpm
    Qdpm
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.

  • CVE-2020-18467MedAug 26, 2021
    Bigtreecms
    Bigtree CMS
    risk 0.35cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.

  • CVE-2021-36352MedAug 26, 2021
    Care2x
    Hospital Information Management
    risk 0.35cvss 5.4epss 0.01

    Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2",…