CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1461 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24196 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized | ||
| CVE-2021-24187 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute. | ||
| CVE-2021-24180 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts… | ||
| CVE-2021-24177 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web… | ||
| CVE-2021-24176 | Med | 0.35 | 5.4 | 0.02 | Apr 5, 2021 | The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard. | ||
| CVE-2021-24168 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium… | ||
| CVE-2021-24157 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could… | ||
| CVE-2021-24156 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation | ||
| CVE-2021-24153 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found. | ||
| CVE-2020-4997 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2020-4792 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | IBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189441. | ||
| CVE-2021-30056 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage. | ||
| CVE-2021-29661 | Med | 0.35 | 5.4 | 0.01 | Apr 2, 2021 | Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page… | ||
| CVE-2021-25893 | Med | 0.35 | 5.4 | 0.01 | Apr 2, 2021 | Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/. | ||
| CVE-2021-23922 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews. | ||
| CVE-2021-28047 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields. | ||
| CVE-2020-19619 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile. | ||
| CVE-2020-19618 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing. | ||
| CVE-2020-19617 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile. | ||
| CVE-2020-19616 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing. |
- risk 0.35cvss 5.4epss 0.01
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
- risk 0.35cvss 5.4epss 0.01
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
- risk 0.35cvss 5.4epss 0.01
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts…
- risk 0.35cvss 5.4epss 0.01
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web…
- risk 0.35cvss 5.4epss 0.02
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
- risk 0.35cvss 5.4epss 0.01
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium…
- risk 0.35cvss 5.4epss 0.01
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could…
- risk 0.35cvss 5.4epss 0.01
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
- risk 0.35cvss 5.4epss 0.01
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.
- risk 0.35cvss 5.4epss 0.01
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.35cvss 5.4epss 0.01
IBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189441.
- risk 0.35cvss 5.4epss 0.01
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
- risk 0.35cvss 5.4epss 0.01
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page…
- risk 0.35cvss 5.4epss 0.01
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews.
- risk 0.35cvss 5.4epss 0.01
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.