CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1582 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-1002005 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter. | ||
| CVE-2018-1002004 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. | ||
| CVE-2018-1002003 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. | ||
| CVE-2018-1002002 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. | ||
| CVE-2018-1002001 | Med | 0.34 | 4.8 | 0.03 | Dec 3, 2018 | There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. | ||
| CVE-2018-19752 | Med | 0.34 | 4.8 | 0.03 | Nov 29, 2018 | DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar. | ||
| CVE-2018-19751 | Med | 0.34 | 4.8 | 0.03 | Nov 29, 2018 | DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields. | ||
| CVE-2018-19749 | Med | 0.34 | 4.8 | 0.03 | Nov 29, 2018 | DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field. | ||
| CVE-2018-18416 | Med | 0.34 | 4.8 | 0.02 | Oct 19, 2018 | LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI. | ||
| CVE-2018-10763 | Med | 0.34 | 4.8 | 0.02 | Sep 14, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page. | ||
| CVE-2018-13832 | Med | 0.34 | 4.8 | 0.02 | Jul 16, 2018 | Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text. | ||
| CVE-2018-12073 | Med | 0.34 | 5.3 | 0.00 | Jun 17, 2018 | An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue (e.g., in combination with a successful XSS, or at an unattended… | ||
| CVE-2018-11564 | Med | 0.34 | 4.8 | 0.03 | Jun 2, 2018 | Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or… | ||
| CVE-2018-11581 | Med | 0.34 | 4.8 | 0.01 | Jun 1, 2018 | Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html. | ||
| CVE-2018-11512 | Med | 0.34 | 4.8 | 0.02 | May 28, 2018 | Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated… | ||
| CVE-2018-10752 | Med | 0.34 | 4.8 | 0.02 | May 5, 2018 | The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action. | ||
| CVE-2018-10321 | Med | 0.34 | 4.8 | 0.02 | Apr 24, 2018 | Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings. | ||
| CVE-2018-10078 | Med | 0.34 | 4.8 | 0.02 | Apr 20, 2018 | Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description. | ||
| CVE-2018-10110 | Med | 0.34 | 4.8 | 0.03 | Apr 18, 2018 | D-Link DIR-615 T1 devices allow XSS via the Add User feature. | ||
| CVE-2018-10118 | Med | 0.34 | 4.8 | 0.03 | Apr 16, 2018 | Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php. |
- risk 0.34cvss 4.8epss 0.03
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- risk 0.34cvss 4.8epss 0.03
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
- risk 0.34cvss 4.8epss 0.03
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
- risk 0.34cvss 4.8epss 0.03
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
- risk 0.34cvss 4.8epss 0.03
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
- risk 0.34cvss 4.8epss 0.02
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI.
- risk 0.34cvss 4.8epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
- risk 0.34cvss 4.8epss 0.02
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
- risk 0.34cvss 5.3epss 0.00
An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue (e.g., in combination with a successful XSS, or at an unattended…
- risk 0.34cvss 4.8epss 0.03
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or…
- risk 0.34cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.
- risk 0.34cvss 4.8epss 0.02
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated…
- risk 0.34cvss 4.8epss 0.02
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
- risk 0.34cvss 4.8epss 0.02
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.
- risk 0.34cvss 4.8epss 0.02
Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description.
- risk 0.34cvss 4.8epss 0.03
D-Link DIR-615 T1 devices allow XSS via the Add User feature.
- risk 0.34cvss 4.8epss 0.03
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.