CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1469 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-25011 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2020 | NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments. | ||
| CVE-2020-25799 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2020 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser. | ||
| CVE-2020-25797 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2020 | LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser. | ||
| CVE-2020-29231 | Med | 0.35 | 5.4 | 0.01 | Dec 30, 2020 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from… | ||
| CVE-2020-5809 | Med | 0.35 | 5.4 | 0.01 | Dec 30, 2020 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS. | ||
| CVE-2020-35774 | Med | 0.35 | 5.4 | 0.86 | Dec 29, 2020 | server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint. | ||
| CVE-2020-26035 | Med | 0.35 | 5.4 | 0.01 | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket. | ||
| CVE-2020-35707 | Med | 0.35 | 5.4 | 0.01 | Dec 25, 2020 | Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. | ||
| CVE-2020-35706 | Med | 0.35 | 5.4 | 0.01 | Dec 25, 2020 | Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. | ||
| CVE-2020-35705 | Med | 0.35 | 5.4 | 0.01 | Dec 25, 2020 | Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. | ||
| CVE-2020-35704 | Med | 0.35 | 5.4 | 0.01 | Dec 25, 2020 | Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. | ||
| CVE-2020-28184 | Med | 0.35 | 5.4 | 0.01 | Dec 24, 2020 | Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php. | ||
| CVE-2018-15641 | Med | 0.35 | 5.4 | 0.01 | Dec 22, 2020 | Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes. | ||
| CVE-2018-15638 | Med | 0.35 | 5.4 | 0.01 | Dec 22, 2020 | Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names. | ||
| CVE-2020-35275 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2020 | Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application. | ||
| CVE-2020-35589 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2020 | The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the… | ||
| CVE-2020-20285 | Med | 0.35 | 5.4 | 0.01 | Dec 18, 2020 | There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php | ||
| CVE-2019-16957 | Med | 0.35 | 5.4 | 0.01 | Dec 18, 2020 | SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. | ||
| CVE-2019-16955 | Med | 0.35 | 5.4 | 0.02 | Dec 18, 2020 | SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. | ||
| CVE-2020-25609 | Med | 0.35 | 5.4 | 0.01 | Dec 18, 2020 | The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data. |
- risk 0.35cvss 5.4epss 0.01
NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments.
- risk 0.35cvss 5.4epss 0.01
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
- risk 0.35cvss 5.4epss 0.01
LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.
- risk 0.35cvss 5.4epss 0.01
EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from…
- risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.
- risk 0.35cvss 5.4epss 0.86
server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.
- risk 0.35cvss 5.4epss 0.01
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
- risk 0.35cvss 5.4epss 0.01
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
- risk 0.35cvss 5.4epss 0.01
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
- risk 0.35cvss 5.4epss 0.01
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
- risk 0.35cvss 5.4epss 0.01
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.
- risk 0.35cvss 5.4epss 0.01
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the…
- risk 0.35cvss 5.4epss 0.01
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
- risk 0.35cvss 5.4epss 0.01
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
- risk 0.35cvss 5.4epss 0.02
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
- risk 0.35cvss 5.4epss 0.01
The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to view and modify user data.