CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1519 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-0556 | Med | 0.35 | 5.4 | 0.02 | Jan 8, 2019 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is… | ||
| CVE-2019-0245 | Med | 0.35 | 5.4 | 0.01 | Jan 8, 2019 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2019-0244 | Med | 0.35 | 5.4 | 0.01 | Jan 8, 2019 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-1918 | Med | 0.35 | 5.4 | 0.01 | Jan 8, 2019 | IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2018-1951 | Med | 0.35 | 5.4 | 0.01 | Jan 4, 2019 | IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2018-1657 | Med | 0.35 | 5.4 | 0.01 | Jan 4, 2019 | IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2018-19918 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2018 | CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI. | ||
| CVE-2018-19906 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2018 | Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. | ||
| CVE-2018-19905 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2018 | HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. | ||
| CVE-2018-19845 | Med | 0.35 | 5.4 | 0.01 | Dec 31, 2018 | There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325. | ||
| CVE-2018-20530 | Med | 0.35 | 5.4 | 0.01 | Dec 28, 2018 | PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896. | ||
| CVE-2018-20373 | Med | 0.35 | 5.4 | 0.01 | Dec 23, 2018 | Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client. | ||
| CVE-2018-20372 | Med | 0.35 | 5.4 | 0.01 | Dec 23, 2018 | TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client. | ||
| CVE-2018-20370 | Med | 0.35 | 5.4 | 0.01 | Dec 23, 2018 | SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend. | ||
| CVE-2018-20368 | Med | 0.35 | 5.4 | 0.01 | Dec 23, 2018 | The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback. | ||
| CVE-2018-20328 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2018 | Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature… | ||
| CVE-2018-20327 | Med | 0.35 | 5.4 | 0.01 | Dec 21, 2018 | Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due… | ||
| CVE-2018-14846 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2018 | The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. | ||
| CVE-2018-1000870 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2018 | PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in… | ||
| CVE-2018-1000847 | Med | 0.35 | 5.4 | 0.01 | Dec 20, 2018 | FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted… |
- risk 0.35cvss 5.4epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is…
- risk 0.35cvss 5.4epss 0.01
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.35cvss 5.4epss 0.01
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.35cvss 5.4epss 0.01
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.35cvss 5.4epss 0.01
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
- risk 0.35cvss 5.4epss 0.01
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
- risk 0.35cvss 5.4epss 0.01
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
- risk 0.35cvss 5.4epss 0.01
There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.
- risk 0.35cvss 5.4epss 0.01
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
- risk 0.35cvss 5.4epss 0.01
Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.
- risk 0.35cvss 5.4epss 0.01
TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.
- risk 0.35cvss 5.4epss 0.01
SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.
- risk 0.35cvss 5.4epss 0.01
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
- risk 0.35cvss 5.4epss 0.01
Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature…
- risk 0.35cvss 5.4epss 0.01
Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due…
- risk 0.35cvss 5.4epss 0.01
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.
- risk 0.35cvss 5.4epss 0.01
PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in…
- risk 0.35cvss 5.4epss 0.01
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted…