CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1578 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-31699 | Med | 0.34 | 4.8 | 0.02 | May 17, 2023 | ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. | ||
| CVE-2023-29848 | Med | 0.34 | 4.8 | 0.02 | Apr 24, 2023 | Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function. | ||
| CVE-2022-2507 | Med | 0.34 | 5.3 | 0.00 | Apr 19, 2023 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage | ||
| CVE-2022-45839 | Med | 0.34 | 5.3 | 0.00 | Apr 18, 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions. | ||
| CVE-2023-0157 | Med | 0.34 | 4.8 | 0.32 | Apr 10, 2023 | The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the… | ||
| CVE-2023-1885 | Med | 0.34 | 6.3 | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1761 | Med | 0.34 | 6.3 | 0.00 | Mar 31, 2023 | Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-22370 | Med | 0.34 | 5.2 | 0.00 | Feb 14, 2023 | Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the… | ||
| CVE-2022-43980 | Med | 0.34 | 5.2 | 0.00 | Jan 27, 2023 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network… | ||
| CVE-2022-39262 | Med | 0.34 | 5.2 | 0.01 | Nov 3, 2022 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal… | ||
| CVE-2021-42751 | Med | 0.34 | 4.8 | 0.03 | Aug 12, 2022 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node. | ||
| CVE-2021-42750 | Med | 0.34 | 4.8 | 0.03 | Aug 12, 2022 | A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node. | ||
| CVE-2021-42535 | Med | 0.34 | 5.3 | 0.00 | Jul 27, 2022 | VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage. | ||
| CVE-2022-34777 | Med | 0.34 | 5.4 | 0.74 | Jun 30, 2022 | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | ||
| CVE-2022-34176 | Med | 0.34 | 5.4 | 0.78 | Jun 23, 2022 | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. | ||
| CVE-2022-29230 | Med | 0.34 | 6.3 | 0.01 | May 18, 2022 | Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of… | ||
| CVE-2021-41810 | Med | 0.34 | 5.2 | 0.01 | May 2, 2022 | Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is… | ||
| CVE-2021-23283 | Med | 0.34 | 5.2 | 0.01 | Apr 19, 2022 | Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software. | ||
| CVE-2022-1163 | Med | 0.34 | 4.8 | 0.04 | Mar 30, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next. | ||
| CVE-2021-27418 | Med | 0.34 | 5.3 | 0.01 | Mar 23, 2022 | GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server… |
- risk 0.34cvss 4.8epss 0.02
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
- risk 0.34cvss 4.8epss 0.02
Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function.
- risk 0.34cvss 5.3epss 0.00
In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage
- risk 0.34cvss 5.3epss 0.00
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions.
- risk 0.34cvss 4.8epss 0.32
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the…
- risk 0.34cvss 6.3epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.34cvss 6.3epss 0.00
Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.34cvss 5.2epss 0.00
Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the…
- risk 0.34cvss 5.2epss 0.00
There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network…
- risk 0.34cvss 5.2epss 0.01
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal…
- risk 0.34cvss 4.8epss 0.03
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.
- risk 0.34cvss 4.8epss 0.03
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.
- risk 0.34cvss 5.3epss 0.00
VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.
- risk 0.34cvss 5.4epss 0.74
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- risk 0.34cvss 5.4epss 0.78
Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
- risk 0.34cvss 6.3epss 0.01
Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of…
- risk 0.34cvss 5.2epss 0.01
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is…
- risk 0.34cvss 5.2epss 0.01
Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.
- risk 0.34cvss 4.8epss 0.04
Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
- risk 0.34cvss 5.3epss 0.01
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server…