CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1445 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-18449 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php | ||
| CVE-2020-20977 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2021 | A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section. | ||
| CVE-2020-21362 | Med | 0.35 | 5.4 | 0.00 | Aug 11, 2021 | A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter. | ||
| CVE-2021-38533 | Med | 0.35 | 5.4 | 0.00 | Aug 11, 2021 | NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS. | ||
| CVE-2020-21930 | Med | 0.35 | 5.4 | 0.01 | Aug 10, 2021 | A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML. | ||
| CVE-2020-21929 | Med | 0.35 | 5.4 | 0.01 | Aug 10, 2021 | A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML. | ||
| CVE-2013-4718 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2021 | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search. | ||
| CVE-2021-37211 | Med | 0.35 | 5.4 | 0.00 | Aug 9, 2021 | The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks. | ||
| CVE-2021-24509 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2021 | The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS… | ||
| CVE-2021-24505 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2021 | The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field. | ||
| CVE-2020-21353 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module. | ||
| CVE-2020-18693 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'. | ||
| CVE-2021-36454 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8)… | ||
| CVE-2021-37552 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | In JetBrains YouTrack before 2021.2.17925, stored XSS was possible. | ||
| CVE-2021-38152 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS. | ||
| CVE-2021-38151 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS. | ||
| CVE-2021-38149 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2021 | index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS. | ||
| CVE-2020-22392 | Med | 0.35 | 5.4 | 0.01 | Aug 5, 2021 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. | ||
| CVE-2021-38138 | Med | 0.35 | 5.4 | 0.02 | Aug 5, 2021 | OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release. | ||
| CVE-2021-38113 | Med | 0.35 | 5.4 | 0.01 | Aug 4, 2021 | In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e., bouqueteditor/api/addbouquet?name=) leads to Stored XSS. |
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.
- risk 0.35cvss 5.4epss 0.00
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
- risk 0.35cvss 5.4epss 0.00
NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search.
- risk 0.35cvss 5.4epss 0.00
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
- risk 0.35cvss 5.4epss 0.01
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS…
- risk 0.35cvss 5.4epss 0.01
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) blocks\blocks.php, 3) brands\brands.php, 4) comments\comments.php, 5) coupons\coupons.php, 6) feeds\feeds.php, 7) functions\functions.php, 8)…
- risk 0.35cvss 5.4epss 0.01
In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
- risk 0.35cvss 5.4epss 0.01
index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.
- risk 0.35cvss 5.4epss 0.01
index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
- risk 0.35cvss 5.4epss 0.01
index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
- risk 0.35cvss 5.4epss 0.02
OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release.
- risk 0.35cvss 5.4epss 0.01
In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e., bouqueteditor/api/addbouquet?name=) leads to Stored XSS.