CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1507 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10851 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). | ||
| CVE-2018-20884 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367). | ||
| CVE-2018-20881 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446). | ||
| CVE-2018-20878 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441). | ||
| CVE-2018-20877 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437). | ||
| CVE-2018-20876 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434). | ||
| CVE-2018-20875 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433). | ||
| CVE-2018-20874 | Med | 0.35 | 5.4 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428). | ||
| CVE-2019-14456 | Med | 0.35 | 5.4 | 0.01 | Jul 31, 2019 | Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging… | ||
| CVE-2019-3958 | Med | 0.35 | 5.4 | 0.01 | Jul 31, 2019 | Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks via a crafted sales transaction. | ||
| CVE-2019-5458 | Med | 0.35 | 5.4 | 0.01 | Jul 30, 2019 | Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser. | ||
| CVE-2019-5457 | Med | 0.35 | 5.4 | 0.01 | Jul 30, 2019 | Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser. | ||
| CVE-2019-14390 | Med | 0.35 | 5.4 | 0.01 | Jul 30, 2019 | cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512). | ||
| CVE-2019-14386 | Med | 0.35 | 5.4 | 0.01 | Jul 30, 2019 | cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504). | ||
| CVE-2019-11199 | Med | 0.35 | 5.4 | 0.01 | Jul 29, 2019 | Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be… | ||
| CVE-2015-6253 | Med | 0.35 | 5.4 | 0.01 | Jul 29, 2019 | edx-platform before 2015-08-17 allows XSS in the Studio listing of courses. | ||
| CVE-2019-1020007 | Med | 0.35 | 5.4 | 0.01 | Jul 29, 2019 | Dependency-Track before 3.5.1 allows XSS. | ||
| CVE-2019-1020003 | Med | 0.35 | 5.4 | 0.01 | Jul 29, 2019 | invenio-records before 1.2.2 allows XSS. | ||
| CVE-2019-1105 | Med | 0.35 | 5.4 | 0.02 | Jul 29, 2019 | A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully… | ||
| CVE-2019-14298 | Med | 0.35 | 5.4 | 0.01 | Jul 27, 2019 | Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx. |
- risk 0.35cvss 5.4epss 0.01
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).
- risk 0.35cvss 5.4epss 0.01
cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).
- risk 0.35cvss 5.4epss 0.01
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging…
- risk 0.35cvss 5.4epss 0.01
Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks via a crafted sales transaction.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
- risk 0.35cvss 5.4epss 0.01
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
- risk 0.35cvss 5.4epss 0.01
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
- risk 0.35cvss 5.4epss 0.01
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be…
- risk 0.35cvss 5.4epss 0.01
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
- risk 0.35cvss 5.4epss 0.01
Dependency-Track before 3.5.1 allows XSS.
- risk 0.35cvss 5.4epss 0.01
invenio-records before 1.2.2 allows XSS.
- risk 0.35cvss 5.4epss 0.02
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully…
- risk 0.35cvss 5.4epss 0.01
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.