CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1502 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16310 | Med | 0.35 | 5.4 | 0.01 | Sep 14, 2019 | NIUSHOP V1.11 has XSS via the index.php?s=/admin URI. | ||
| CVE-2019-16289 | Med | 0.35 | 5.4 | 0.01 | Sep 13, 2019 | The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. | ||
| CVE-2016-10953 | Med | 0.35 | 5.4 | 0.01 | Sep 13, 2019 | The Headway theme before 3.8.9 for WordPress has XSS via the license key field. | ||
| CVE-2019-5975 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2019 | DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-1305 | Med | 0.35 | 5.4 | 0.02 | Sep 11, 2019 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | ||
| CVE-2019-1273 | Med | 0.35 | 5.4 | 0.02 | Sep 11, 2019 | A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'. | ||
| CVE-2019-3761 | Med | 0.35 | 5.4 | 0.01 | Sep 11, 2019 | The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this… | ||
| CVE-2019-16193 | Med | 0.35 | 5.4 | 0.01 | Sep 11, 2019 | In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature. | ||
| CVE-2017-18601 | Med | 0.35 | 5.4 | 0.01 | Sep 10, 2019 | The examapp plugin 1.0 for WordPress has XSS via exam input text fields. | ||
| CVE-2017-18600 | Med | 0.35 | 5.4 | 0.01 | Sep 10, 2019 | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | ||
| CVE-2019-11548 | Med | 0.35 | 5.4 | 0.01 | Sep 9, 2019 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint. | ||
| CVE-2019-5471 | Med | 0.35 | 5.4 | 0.01 | Sep 9, 2019 | An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6. | ||
| CVE-2019-5467 | Med | 0.35 | 5.4 | 0.01 | Sep 9, 2019 | An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6. | ||
| CVE-2018-21014 | Med | 0.35 | 5.4 | 0.01 | Sep 9, 2019 | The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. | ||
| CVE-2019-4149 | Med | 0.35 | 5.4 | 0.01 | Sep 5, 2019 | IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This… | ||
| CVE-2019-15870 | Med | 0.35 | 5.4 | 0.01 | Sep 3, 2019 | The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. | ||
| CVE-2019-15869 | Med | 0.35 | 5.4 | 0.01 | Sep 3, 2019 | The JobCareer theme before 2.5.1 for WordPress has stored XSS. | ||
| CVE-2019-15837 | Med | 0.35 | 5.4 | 0.01 | Aug 30, 2019 | The webp-express plugin before 0.14.8 for WordPress has stored XSS. | ||
| CVE-2019-15836 | Med | 0.35 | 5.4 | 0.01 | Aug 30, 2019 | The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. | ||
| CVE-2019-15830 | Med | 0.35 | 5.4 | 0.01 | Aug 30, 2019 | The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. |
- risk 0.35cvss 5.4epss 0.01
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
- risk 0.35cvss 5.4epss 0.01
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
- risk 0.35cvss 5.4epss 0.01
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
- risk 0.35cvss 5.4epss 0.01
DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.35cvss 5.4epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
- risk 0.35cvss 5.4epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error messages, aka 'Active Directory Federation Services XSS Vulnerability'.
- risk 0.35cvss 5.4epss 0.01
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this…
- risk 0.35cvss 5.4epss 0.01
In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.
- risk 0.35cvss 5.4epss 0.01
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
- risk 0.35cvss 5.4epss 0.01
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.
- risk 0.35cvss 5.4epss 0.01
An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
- risk 0.35cvss 5.4epss 0.01
An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
- risk 0.35cvss 5.4epss 0.01
The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
- risk 0.35cvss 5.4epss 0.01
IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This…
- risk 0.35cvss 5.4epss 0.01
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
- risk 0.35cvss 5.4epss 0.01
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
- risk 0.35cvss 5.4epss 0.01
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
- risk 0.35cvss 5.4epss 0.01
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
- risk 0.35cvss 5.4epss 0.01
The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.