CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1503 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-15827 | Med | 0.35 | 5.4 | 0.01 | Aug 30, 2019 | The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. | ||
| CVE-2019-15778 | Med | 0.35 | 5.4 | 0.01 | Aug 29, 2019 | The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS. | ||
| CVE-2019-15777 | Med | 0.35 | 5.4 | 0.01 | Aug 29, 2019 | The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS. | ||
| CVE-2019-15230 | Med | 0.35 | 5.4 | 0.01 | Aug 28, 2019 | LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an… | ||
| CVE-2019-8444 | Med | 0.35 | 5.4 | 0.01 | Aug 23, 2019 | The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification. | ||
| CVE-2019-15480 | Med | 0.35 | 5.4 | 0.01 | Aug 23, 2019 | Domoticz 4.10717 has XSS via item.Name. | ||
| CVE-2018-20986 | Med | 0.35 | 5.4 | 0.01 | Aug 22, 2019 | The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors. | ||
| CVE-2019-12386 | Med | 0.35 | 5.4 | 0.01 | Aug 22, 2019 | An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose… | ||
| CVE-2019-14469 | Med | 0.35 | 5.4 | 0.01 | Aug 22, 2019 | In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. | ||
| CVE-2019-15317 | Med | 0.35 | 5.4 | 0.01 | Aug 22, 2019 | The give plugin before 2.4.7 for WordPress has XSS via a donor name. | ||
| CVE-2019-15314 | Med | 0.35 | 5.4 | 0.01 | Aug 22, 2019 | tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI. | ||
| CVE-2019-15127 | Med | 0.35 | 5.4 | 0.01 | Aug 21, 2019 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. | ||
| CVE-2019-4482 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2019 | IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2019-4120 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2019 | IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-11522 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2019 | OX App Suite 7.10.0 to 7.10.2 allows XSS. | ||
| CVE-2019-15228 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2019 | FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors. | ||
| CVE-2019-15120 | Med | 0.35 | 5.4 | 0.01 | Aug 16, 2019 | The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode. | ||
| CVE-2018-17790 | Med | 0.35 | 5.4 | 0.01 | Aug 15, 2019 | Prospecta Master Data Online (MDO) 2.0 has Stored XSS. | ||
| CVE-2018-12101 | Med | 0.35 | 5.4 | 0.01 | Aug 15, 2019 | CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields. | ||
| CVE-2019-14518 | Med | 0.35 | 5.4 | 0.01 | Aug 15, 2019 | Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel. |
- risk 0.35cvss 5.4epss 0.01
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
- risk 0.35cvss 5.4epss 0.01
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
- risk 0.35cvss 5.4epss 0.01
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
- risk 0.35cvss 5.4epss 0.01
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an…
- risk 0.35cvss 5.4epss 0.01
The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.
- risk 0.35cvss 5.4epss 0.01
Domoticz 4.10717 has XSS via item.Name.
- risk 0.35cvss 5.4epss 0.01
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose…
- risk 0.35cvss 5.4epss 0.01
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
- risk 0.35cvss 5.4epss 0.01
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
- risk 0.35cvss 5.4epss 0.01
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
- risk 0.35cvss 5.4epss 0.01
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
- risk 0.35cvss 5.4epss 0.01
IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.35cvss 5.4epss 0.01
IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
OX App Suite 7.10.0 to 7.10.2 allows XSS.
- risk 0.35cvss 5.4epss 0.01
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
- risk 0.35cvss 5.4epss 0.01
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
- risk 0.35cvss 5.4epss 0.01
Prospecta Master Data Online (MDO) 2.0 has Stored XSS.
- risk 0.35cvss 5.4epss 0.01
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
- risk 0.35cvss 5.4epss 0.01
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.