CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1477 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-2246 | Med | 0.35 | 5.4 | 0.01 | Sep 1, 2020 | Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents. | ||
| CVE-2020-2243 | Med | 0.35 | 5.4 | 0.01 | Sep 1, 2020 | Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. | ||
| CVE-2020-20626 | Med | 0.35 | 5.4 | 0.01 | Aug 31, 2020 | lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. | ||
| CVE-2020-13828 | Med | 0.35 | 5.4 | 0.01 | Aug 31, 2020 | Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php… | ||
| CVE-2020-12646 | Med | 0.35 | 5.4 | 0.01 | Aug 31, 2020 | OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. | ||
| CVE-2020-15020 | Med | 0.35 | 5.4 | 0.01 | Aug 31, 2020 | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field. | ||
| CVE-2020-23576 | Med | 0.35 | 5.4 | 0.01 | Aug 27, 2020 | Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab. | ||
| CVE-2020-23984 | Med | 0.35 | 5.4 | 0.01 | Aug 27, 2020 | Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags. | ||
| CVE-2020-23983 | Med | 0.35 | 5.4 | 0.01 | Aug 27, 2020 | Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags. | ||
| CVE-2020-23974 | Med | 0.35 | 5.4 | 0.01 | Aug 27, 2020 | Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags). | ||
| CVE-2019-4691 | Med | 0.35 | 5.4 | 0.00 | Aug 26, 2020 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2020-23660 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search." | ||
| CVE-2020-23659 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature. | ||
| CVE-2020-23658 | Med | 0.35 | 5.4 | 0.00 | Aug 26, 2020 | PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. | ||
| CVE-2020-23657 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." | ||
| CVE-2020-23656 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content." | ||
| CVE-2020-23655 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." | ||
| CVE-2020-23654 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop." | ||
| CVE-2020-13821 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the… | ||
| CVE-2020-19007 | Med | 0.35 | 5.4 | 0.01 | Aug 26, 2020 | Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser. |
- risk 0.35cvss 5.4epss 0.01
Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.
- risk 0.35cvss 5.4epss 0.01
Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
- risk 0.35cvss 5.4epss 0.01
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
- risk 0.35cvss 5.4epss 0.01
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php…
- risk 0.35cvss 5.4epss 0.01
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
- risk 0.35cvss 5.4epss 0.01
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
- risk 0.35cvss 5.4epss 0.01
Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.
- risk 0.35cvss 5.4epss 0.01
Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
- risk 0.35cvss 5.4epss 0.01
Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).
- risk 0.35cvss 5.4epss 0.00
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.35cvss 5.4epss 0.01
webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
- risk 0.35cvss 5.4epss 0.01
WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.
- risk 0.35cvss 5.4epss 0.00
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
- risk 0.35cvss 5.4epss 0.01
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- risk 0.35cvss 5.4epss 0.01
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
- risk 0.35cvss 5.4epss 0.01
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- risk 0.35cvss 5.4epss 0.01
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the…
- risk 0.35cvss 5.4epss 0.01
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser.