CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1627 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-43647 | Med | 0.33 | 6.1 | 0.01 | Oct 30, 2023 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue. | ||
| CVE-2023-29009 | Med | 0.33 | 6.1 | 0.01 | Oct 27, 2023 | baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0. | ||
| CVE-2023-46134 | Med | 0.33 | 6.1 | 0.01 | Oct 25, 2023 | D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has… | ||
| CVE-2023-43643 | Med | 0.33 | 6.1 | 0.01 | Oct 9, 2023 | AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this… | ||
| CVE-2023-44390 | Med | 0.33 | 6.1 | 0.00 | Oct 5, 2023 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an… | ||
| CVE-2023-5323 | Med | 0.33 | 6.1 | 0.00 | Oct 1, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. | ||
| CVE-2023-5320 | Med | 0.33 | 6.1 | 0.01 | Sep 30, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. | ||
| CVE-2023-5316 | Med | 0.33 | 6.1 | 0.00 | Sep 30, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18. | ||
| CVE-2023-26149 | Med | 0.33 | 6.1 | 0.01 | Sep 28, 2023 | Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:** If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection… | ||
| CVE-2023-5244 | Med | 0.33 | 6.1 | 0.01 | Sep 28, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0. | ||
| CVE-2018-5478 | Med | 0.33 | 6.1 | 0.00 | Sep 21, 2023 | Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension. | ||
| CVE-2023-5060 | Med | 0.33 | 6.1 | 0.01 | Sep 19, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. | ||
| CVE-2023-4978 | Med | 0.33 | 6.1 | 0.01 | Sep 15, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. | ||
| CVE-2023-4913 | Med | 0.33 | 6.1 | 0.01 | Sep 12, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1. | ||
| CVE-2023-39062 | Med | 0.33 | 6.1 | 0.01 | Aug 28, 2023 | Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php. | ||
| CVE-2023-40030 | Med | 0.33 | 6.1 | 0.01 | Aug 24, 2023 | Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may… | ||
| CVE-2023-32497 | Med | 0.33 | 5.1 | 0.00 | Aug 23, 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 versions. | ||
| CVE-2023-4451 | Med | 0.33 | 6.1 | 0.02 | Aug 20, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | ||
| CVE-2023-4432 | Med | 0.33 | 6.1 | 0.01 | Aug 19, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | ||
| CVE-2023-26140 | Med | 0.33 | 6.1 | 0.01 | Aug 16, 2023 | Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization. |
- risk 0.33cvss 6.1epss 0.01
baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Version 4.8.0 contains a patch for this issue.
- risk 0.33cvss 6.1epss 0.01
baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.
- risk 0.33cvss 6.1epss 0.01
D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has…
- risk 0.33cvss 6.1epss 0.01
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this…
- risk 0.33cvss 6.1epss 0.00
HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed elements. In the case an…
- risk 0.33cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
- risk 0.33cvss 6.1epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
- risk 0.33cvss 6.1epss 0.01
Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:** If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection…
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
- risk 0.33cvss 6.1epss 0.00
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
- risk 0.33cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
- risk 0.33cvss 6.1epss 0.01
Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may…
- risk 0.33cvss 5.1epss 0.00
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 versions.
- risk 0.33cvss 6.1epss 0.02
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
- risk 0.33cvss 6.1epss 0.01
Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.