CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1501 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-9423 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters. | ||
| CVE-2015-9410 | Med | 0.35 | 5.4 | 0.01 | Sep 26, 2019 | The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. | ||
| CVE-2019-16890 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments. | ||
| CVE-2019-4571 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2019-6653 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. The attack can be stored by users granted the Device Manager and Administrator roles. | ||
| CVE-2019-10410 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules. | ||
| CVE-2019-10403 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2019 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions. | ||
| CVE-2019-16661 | Med | 0.35 | 5.4 | 0.01 | Sep 21, 2019 | Ogma CMS 0.5 has XSS via creation of a new blog. | ||
| CVE-2019-16643 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area. | ||
| CVE-2015-9397 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. | ||
| CVE-2015-9393 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. | ||
| CVE-2015-9392 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. | ||
| CVE-2016-11012 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS. | ||
| CVE-2015-9389 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. | ||
| CVE-2019-14913 | Med | 0.35 | 5.4 | 0.01 | Sep 20, 2019 | An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel. | ||
| CVE-2019-6835 | Med | 0.35 | 5.4 | 0.01 | Sep 17, 2019 | A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an… | ||
| CVE-2019-4342 | Med | 0.35 | 5.4 | 0.01 | Sep 17, 2019 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-4270 | Med | 0.35 | 5.4 | 0.01 | Sep 17, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure… | ||
| CVE-2016-10993 | Med | 0.35 | 5.4 | 0.03 | Sep 17, 2019 | The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. | ||
| CVE-2019-16333 | Med | 0.35 | 5.4 | 0.01 | Sep 15, 2019 | GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php. |
- risk 0.35cvss 5.4epss 0.01
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
- risk 0.35cvss 5.4epss 0.01
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
- risk 0.35cvss 5.4epss 0.01
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.
- risk 0.35cvss 5.4epss 0.01
IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.35cvss 5.4epss 0.01
There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. The attack can be stored by users granted the Device Manager and Administrator roles.
- risk 0.35cvss 5.4epss 0.01
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules.
- risk 0.35cvss 5.4epss 0.01
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- risk 0.35cvss 5.4epss 0.01
Ogma CMS 0.5 has XSS via creation of a new blog.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.
- risk 0.35cvss 5.4epss 0.01
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
- risk 0.35cvss 5.4epss 0.01
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
- risk 0.35cvss 5.4epss 0.01
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
- risk 0.35cvss 5.4epss 0.01
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
- risk 0.35cvss 5.4epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel.
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an…
- risk 0.35cvss 5.4epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
- risk 0.35cvss 5.4epss 0.03
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
- risk 0.35cvss 5.4epss 0.01
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.