CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1526 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-17090 | Med | 0.35 | 5.4 | 0.01 | Sep 16, 2018 | An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing followed by tags. | ||
| CVE-2018-8431 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2018 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server,… | ||
| CVE-2018-8428 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2018 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This… | ||
| CVE-2018-8426 | Med | 0.35 | 5.4 | 0.02 | Sep 13, 2018 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint Server,… | ||
| CVE-2018-16729 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. | ||
| CVE-2018-16728 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new. | ||
| CVE-2018-16727 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component. | ||
| CVE-2018-16726 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component. | ||
| CVE-2018-16605 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page. | ||
| CVE-2018-16780 | Med | 0.35 | 5.4 | 0.00 | Sep 10, 2018 | Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment. | ||
| CVE-2018-9283 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2018 | An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address,… | ||
| CVE-2018-14397 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2018 | An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department,… | ||
| CVE-2018-14396 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2018 | An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department,… | ||
| CVE-2017-1114 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2018 | IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2018-16622 | Med | 0.35 | 5.4 | 0.01 | Sep 6, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent. | ||
| CVE-2018-16551 | Med | 0.35 | 5.4 | 0.01 | Sep 5, 2018 | LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit. | ||
| CVE-2018-15676 | Med | 0.35 | 5.3 | 0.01 | Sep 5, 2018 | An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints. | ||
| CVE-2018-16358 | Med | 0.35 | 5.4 | 0.01 | Sep 2, 2018 | A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml. | ||
| CVE-2018-16342 | Med | 0.35 | 5.4 | 0.01 | Sep 2, 2018 | ShowDoc v1.8.0 has XSS via a new page. | ||
| CVE-2018-16316 | Med | 0.35 | 5.4 | 0.01 | Sep 1, 2018 | A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field. |
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing followed by tags.
- risk 0.35cvss 5.4epss 0.02
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server,…
- risk 0.35cvss 5.4epss 0.02
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This…
- risk 0.35cvss 5.4epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint Server,…
- risk 0.35cvss 5.4epss 0.01
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.
- risk 0.35cvss 5.4epss 0.01
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.
- risk 0.35cvss 5.4epss 0.01
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
- risk 0.35cvss 5.4epss 0.01
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
- risk 0.35cvss 5.4epss 0.01
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
- risk 0.35cvss 5.4epss 0.00
Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.
- risk 0.35cvss 5.4epss 0.01
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address,…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department,…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department,…
- risk 0.35cvss 5.4epss 0.01
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
- risk 0.35cvss 5.4epss 0.01
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
- risk 0.35cvss 5.3epss 0.01
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
- risk 0.35cvss 5.4epss 0.01
ShowDoc v1.8.0 has XSS via a new page.
- risk 0.35cvss 5.4epss 0.01
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.