CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1580 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-22841 | Med | 0.34 | 4.8 | 0.04 | Feb 9, 2021 | Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module. | ||
| CVE-2021-23327 | Med | 0.34 | 6.3 | 0.01 | Feb 9, 2021 | The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields. | ||
| CVE-2021-3111 | Med | 0.34 | 4.8 | 0.03 | Jan 8, 2021 | The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI. | ||
| CVE-2020-35241 | Med | 0.34 | 4.8 | 0.02 | Dec 30, 2020 | FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can… | ||
| CVE-2020-29477 | Med | 0.34 | 4.8 | 0.01 | Dec 30, 2020 | Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie… | ||
| CVE-2020-29471 | Med | 0.34 | 4.8 | 0.01 | Dec 29, 2020 | OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger. | ||
| CVE-2020-29470 | Med | 0.34 | 4.8 | 0.02 | Dec 29, 2020 | OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the… | ||
| CVE-2020-29475 | Med | 0.34 | 4.8 | 0.01 | Dec 29, 2020 | nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can… | ||
| CVE-2020-17515 | Med | 0.34 | 6.1 | 0.16 | Dec 11, 2020 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely. | ||
| CVE-2020-29240 | Med | 0.34 | 4.8 | 0.02 | Dec 2, 2020 | Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered. | ||
| CVE-2020-4740 | Med | 0.34 | 5.2 | 0.01 | Oct 12, 2020 | IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150. | ||
| CVE-2020-7691 | Med | 0.34 | 6.3 | 0.02 | Jul 6, 2020 | In all versions of the package jspdf, it is possible to use <script> in order to go over the filtering regex. | ||
| CVE-2020-14166 | Med | 0.34 | 4.8 | 0.02 | Jul 1, 2020 | The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a… | ||
| CVE-2019-20759 | Med | 0.34 | 5.2 | 0.00 | Apr 16, 2020 | NETGEAR R9000 devices before 1.0.4.26 are affected by stored XSS. | ||
| CVE-2019-20743 | Med | 0.34 | 5.2 | 0.00 | Apr 16, 2020 | NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS. | ||
| CVE-2019-20742 | Med | 0.34 | 5.2 | 0.00 | Apr 16, 2020 | NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS. | ||
| CVE-2020-9371 | Med | 0.34 | 4.8 | 0.03 | Mar 4, 2020 | Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML. | ||
| CVE-2019-15253 | Med | 0.34 | 4.8 | 0.03 | Feb 5, 2020 | A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected… | ||
| CVE-2020-8493 | Med | 0.34 | 4.8 | 0.01 | Jan 30, 2020 | A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated… | ||
| CVE-2019-12703 | Med | 0.34 | 5.2 | 0.00 | Oct 16, 2019 | A vulnerability in the web-based management interface of Cisco SPA122 ATA with Router Devices could allow an unauthenticated, adjacent attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input by the web-based… |
- risk 0.34cvss 4.8epss 0.04
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.
- risk 0.34cvss 6.3epss 0.01
The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
- risk 0.34cvss 4.8epss 0.03
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
- risk 0.34cvss 4.8epss 0.02
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can…
- risk 0.34cvss 4.8epss 0.01
Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie…
- risk 0.34cvss 4.8epss 0.01
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.
- risk 0.34cvss 4.8epss 0.02
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the…
- risk 0.34cvss 4.8epss 0.01
nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can…
- risk 0.34cvss 6.1epss 0.16
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
- risk 0.34cvss 4.8epss 0.02
Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered.
- risk 0.34cvss 5.2epss 0.01
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150.
- risk 0.34cvss 6.3epss 0.02
In all versions of the package jspdf, it is possible to use <script> in order to go over the filtering regex.
- risk 0.34cvss 4.8epss 0.02
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a…
- risk 0.34cvss 5.2epss 0.00
NETGEAR R9000 devices before 1.0.4.26 are affected by stored XSS.
- risk 0.34cvss 5.2epss 0.00
NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS.
- risk 0.34cvss 5.2epss 0.00
NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS.
- risk 0.34cvss 4.8epss 0.03
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
- risk 0.34cvss 4.8epss 0.03
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected…
- risk 0.34cvss 4.8epss 0.01
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated…
- risk 0.34cvss 5.2epss 0.00
A vulnerability in the web-based management interface of Cisco SPA122 ATA with Router Devices could allow an unauthenticated, adjacent attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input by the web-based…