CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1533 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-0340 | Med | 0.35 | 5.4 | 0.01 | Jun 7, 2018 | A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is… | ||
| CVE-2018-3716 | Med | 0.35 | 5.4 | 0.01 | Jun 7, 2018 | simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. | ||
| CVE-2018-1000202 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2018 | A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user… | ||
| CVE-2017-18286 | Med | 0.35 | 5.4 | 0.01 | Jun 5, 2018 | nZEDb v0.7.3.3 has XSS in the 404 error page. | ||
| CVE-2018-10382 | Med | 0.35 | 5.4 | 0.01 | Jun 1, 2018 | MODX Revolution 2.6.3 has XSS. | ||
| CVE-2018-7976 | Med | 0.35 | 5.4 | 0.00 | Jun 1, 2018 | There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system… | ||
| CVE-2018-1496 | Med | 0.35 | 5.4 | 0.01 | May 31, 2018 | IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2018-11580 | Med | 0.35 | 5.4 | 0.01 | May 31, 2018 | An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS… | ||
| CVE-2018-11572 | Med | 0.35 | 5.4 | 0.01 | May 31, 2018 | ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI. | ||
| CVE-2018-11559 | Med | 0.35 | 5.4 | 0.01 | May 30, 2018 | DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter. | ||
| CVE-2018-11558 | Med | 0.35 | 5.4 | 0.01 | May 30, 2018 | DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter. | ||
| CVE-2018-11549 | Med | 0.35 | 5.4 | 0.01 | May 29, 2018 | An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring. | ||
| CVE-2018-11430 | Med | 0.35 | 5.4 | 0.01 | May 28, 2018 | An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea. | ||
| CVE-2018-11471 | Med | 0.35 | 5.4 | 0.01 | May 25, 2018 | Cockpit 0.5.5 has XSS via a collection, form, or region. | ||
| CVE-2018-6495 | Med | 0.35 | 5.4 | 0.01 | May 23, 2018 | Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be… | ||
| CVE-2018-11343 | Med | 0.35 | 5.4 | 0.01 | May 22, 2018 | A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter. | ||
| CVE-2018-1147 | Med | 0.35 | 5.4 | 0.01 | May 18, 2018 | In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session.… | ||
| CVE-2018-1461 | Med | 0.35 | 5.4 | 0.01 | May 17, 2018 | IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed… | ||
| CVE-2018-10326 | Med | 0.35 | 5.4 | 0.01 | May 17, 2018 | PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest. | ||
| CVE-2018-0578 | Med | 0.35 | 5.4 | 0.01 | May 14, 2018 | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is…
- risk 0.35cvss 5.4epss 0.01
simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
- risk 0.35cvss 5.4epss 0.01
A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user…
- risk 0.35cvss 5.4epss 0.01
nZEDb v0.7.3.3 has XSS in the 404 error page.
- risk 0.35cvss 5.4epss 0.01
MODX Revolution 2.6.3 has XSS.
- risk 0.35cvss 5.4epss 0.00
There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system…
- risk 0.35cvss 5.4epss 0.01
IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS…
- risk 0.35cvss 5.4epss 0.01
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
- risk 0.35cvss 5.4epss 0.01
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.
- risk 0.35cvss 5.4epss 0.01
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.
- risk 0.35cvss 5.4epss 0.01
Cockpit 0.5.5 has XSS via a collection, form, or region.
- risk 0.35cvss 5.4epss 0.01
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be…
- risk 0.35cvss 5.4epss 0.01
A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter.
- risk 0.35cvss 5.4epss 0.01
In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session.…
- risk 0.35cvss 5.4epss 0.01
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed…
- risk 0.35cvss 5.4epss 0.01
PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.