CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1444 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-20753 | Med | 0.35 | 5.4 | 0.01 | Aug 18, 2021 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-39250 | Med | 0.35 | 5.4 | 0.01 | Aug 17, 2021 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an… | ||
| CVE-2020-4706 | Med | 0.35 | 5.4 | 0.01 | Aug 17, 2021 | IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will… | ||
| CVE-2021-38752 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrarily inject code in the search bar. | ||
| CVE-2021-38607 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. | ||
| CVE-2021-24548 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page. | ||
| CVE-2021-24541 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. | ||
| CVE-2021-24540 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. | ||
| CVE-2021-24538 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. | ||
| CVE-2021-24534 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue. | ||
| CVE-2021-24526 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting… | ||
| CVE-2021-24512 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos. | ||
| CVE-2021-24471 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style,… | ||
| CVE-2021-38713 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2021 | imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header. | ||
| CVE-2021-38708 | Med | 0.35 | 5.4 | 0.00 | Aug 16, 2021 | In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS. | ||
| CVE-2020-20990 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter. | ||
| CVE-2020-20988 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter. | ||
| CVE-2021-37700 | Med | 0.35 | 6.5 | 0.02 | Aug 12, 2021 | @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string ``, a **div** is dynamically created, and the clipboard… | ||
| CVE-2021-36950 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||
| CVE-2021-36946 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | Microsoft Dynamics Business Central Cross-site Scripting Vulnerability |
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
- risk 0.35cvss 5.4epss 0.01
Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an…
- risk 0.35cvss 5.4epss 0.01
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will…
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrarily inject code in the search bar.
- risk 0.35cvss 5.4epss 0.01
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
- risk 0.35cvss 5.4epss 0.01
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
- risk 0.35cvss 5.4epss 0.01
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
- risk 0.35cvss 5.4epss 0.01
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
- risk 0.35cvss 5.4epss 0.01
The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
- risk 0.35cvss 5.4epss 0.01
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
- risk 0.35cvss 5.4epss 0.01
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting…
- risk 0.35cvss 5.4epss 0.01
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
- risk 0.35cvss 5.4epss 0.01
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2. by using style,…
- risk 0.35cvss 5.4epss 0.01
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
- risk 0.35cvss 5.4epss 0.00
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
- risk 0.35cvss 5.4epss 0.01
A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
- risk 0.35cvss 5.4epss 0.01
A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.
- risk 0.35cvss 6.5epss 0.02
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string ``, a **div** is dynamically created, and the clipboard…
- risk 0.35cvss 5.4epss 0.01
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
- risk 0.35cvss 5.4epss 0.01
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability