CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1581 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-15081 | Med | 0.34 | 4.8 | 0.02 | Aug 15, 2019 | OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages. | ||
| CVE-2019-14804 | Med | 0.34 | 4.8 | 0.03 | Aug 9, 2019 | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. | ||
| CVE-2016-10864 | Med | 0.34 | 5.2 | 0.01 | Aug 8, 2019 | NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID. | ||
| CVE-2019-13029 | Med | 0.34 | 4.8 | 0.02 | Jul 11, 2019 | Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser. | ||
| CVE-2019-9701 | Med | 0.34 | 4.8 | 0.02 | Jun 19, 2019 | DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to… | ||
| CVE-2019-6588 | Med | 0.34 | 4.7 | 0.02 | Jun 3, 2019 | In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay… | ||
| CVE-2019-12195 | Med | 0.34 | 4.8 | 0.02 | May 24, 2019 | TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the… | ||
| CVE-2019-10893 | Med | 0.34 | 4.8 | 0.03 | Apr 18, 2019 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save… | ||
| CVE-2019-11017 | Med | 0.34 | 4.8 | 0.01 | Apr 18, 2019 | On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter. | ||
| CVE-2019-10261 | Med | 0.34 | 4.8 | 0.02 | Apr 3, 2019 | CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action. | ||
| CVE-2019-8331 | Med | 0.34 | 6.1 | 0.16 | Feb 20, 2019 | In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. | ||
| CVE-2019-6263 | Med | 0.34 | 4.8 | 0.04 | Jan 16, 2019 | An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS. | ||
| CVE-2019-3501 | Med | 0.34 | 4.8 | 0.02 | Jan 2, 2019 | The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile. | ||
| CVE-2018-20418 | Med | 0.34 | 4.8 | 0.04 | Dec 24, 2018 | index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. | ||
| CVE-2018-19914 | Med | 0.34 | 4.8 | 0.03 | Dec 6, 2018 | DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field. | ||
| CVE-2018-19913 | Med | 0.34 | 4.8 | 0.02 | Dec 6, 2018 | DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field. | ||
| CVE-2018-1002009 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable. | ||
| CVE-2018-1002008 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable. | ||
| CVE-2018-1002007 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id. | ||
| CVE-2018-1002006 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes |
- risk 0.34cvss 4.8epss 0.02
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
- risk 0.34cvss 4.8epss 0.03
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
- risk 0.34cvss 5.2epss 0.01
NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
- risk 0.34cvss 4.8epss 0.02
Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.
- risk 0.34cvss 4.8epss 0.02
DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to…
- risk 0.34cvss 4.7epss 0.02
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay…
- risk 0.34cvss 4.8epss 0.02
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the…
- risk 0.34cvss 4.8epss 0.03
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save…
- risk 0.34cvss 4.8epss 0.01
On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter.
- risk 0.34cvss 4.8epss 0.02
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.
- risk 0.34cvss 6.1epss 0.16
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
- risk 0.34cvss 4.8epss 0.04
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.
- risk 0.34cvss 4.8epss 0.02
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.
- risk 0.34cvss 4.8epss 0.04
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
- risk 0.34cvss 4.8epss 0.03
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
- risk 0.34cvss 4.8epss 0.02
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.
- risk 0.34cvss 4.8epss 0.03
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes