CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1629 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-29016 | Med | 0.33 | 6.1 | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter… | ||
| CVE-2023-29015 | Med | 0.33 | 6.1 | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted… | ||
| CVE-2023-29014 | Med | 0.33 | 6.1 | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a… | ||
| CVE-2023-1884 | Med | 0.33 | 6.1 | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1880 | Med | 0.33 | 6.1 | 0.02 | Apr 5, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-28851 | Med | 0.33 | 6.1 | 0.00 | Apr 3, 2023 | Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to… | ||
| CVE-2023-28850 | Med | 0.33 | 6.1 | 0.01 | Apr 3, 2023 | Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect… | ||
| CVE-2023-28332 | Med | 0.33 | 6.1 | 0.01 | Mar 23, 2023 | If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk. | ||
| CVE-2023-28331 | Med | 0.33 | 6.1 | 0.01 | Mar 23, 2023 | Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk. | ||
| CVE-2023-1410 | Med | 0.33 | 6.2 | 0.01 | Mar 23, 2023 | Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An… | ||
| CVE-2022-45004 | Med | 0.33 | 6.1 | 0.01 | Mar 22, 2023 | Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. | ||
| CVE-2023-28429 | Med | 0.33 | 6.1 | 0.01 | Mar 20, 2023 | Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through… | ||
| CVE-2023-28106 | Med | 0.33 | 6.1 | 0.01 | Mar 16, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch… | ||
| CVE-2023-23408 | Med | 0.33 | 4.5 | 0.04 | Mar 14, 2023 | Azure Apache Ambari Spoofing Vulnerability | ||
| CVE-2021-46875 | Med | 0.33 | 6.1 | 0.00 | Mar 12, 2023 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file. | ||
| CVE-2022-4862 | Med | 0.33 | 5.0 | 0.00 | Mar 6, 2023 | Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3. | ||
| CVE-2023-26091 | Med | 0.33 | 6.1 | 0.00 | Feb 26, 2023 | The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails. | ||
| CVE-2022-48345 | Med | 0.33 | 6.1 | 0.01 | Feb 24, 2023 | sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities. | ||
| CVE-2021-32860 | Med | 0.33 | 6.1 | 0.01 | Feb 21, 2023 | iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arbitrary `html` or… | ||
| CVE-2021-32856 | Med | 0.33 | 6.1 | 0.01 | Feb 21, 2023 | Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A… |
- risk 0.33cvss 6.1epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter…
- risk 0.33cvss 6.1epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted…
- risk 0.33cvss 6.1epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a…
- risk 0.33cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.33cvss 6.1epss 0.02
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.33cvss 6.1epss 0.00
Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to…
- risk 0.33cvss 6.1epss 0.01
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect…
- risk 0.33cvss 6.1epss 0.01
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
- risk 0.33cvss 6.1epss 0.01
Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
- risk 0.33cvss 6.2epss 0.01
Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An…
- risk 0.33cvss 6.1epss 0.01
Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
- risk 0.33cvss 6.1epss 0.01
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through…
- risk 0.33cvss 6.1epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch…
- risk 0.33cvss 4.5epss 0.04
Azure Apache Ambari Spoofing Vulnerability
- risk 0.33cvss 6.1epss 0.00
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
- risk 0.33cvss 5.0epss 0.00
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.
- risk 0.33cvss 6.1epss 0.00
The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.
- risk 0.33cvss 6.1epss 0.01
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
- risk 0.33cvss 6.1epss 0.01
iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arbitrary `html` or…
- risk 0.33cvss 6.1epss 0.01
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A…