CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1634 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1782 | Med | 0.33 | 6.1 | 0.01 | May 18, 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11. | ||
| CVE-2022-1682 | Med | 0.33 | 6.1 | 0.01 | May 12, 2022 | Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser | ||
| CVE-2022-29172 | Med | 0.33 | 6.1 | 0.01 | May 5, 2022 | Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/loc… | ||
| CVE-2022-30241 | Med | 0.33 | 6.1 | 0.01 | May 4, 2022 | The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. | ||
| CVE-2022-1584 | Med | 0.33 | 6.1 | 0.01 | May 4, 2022 | Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim | ||
| CVE-2022-1571 | Med | 0.33 | 6.1 | 0.01 | May 4, 2022 | Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ... | ||
| CVE-2022-1555 | Med | 0.33 | 6.1 | 0.01 | May 4, 2022 | DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie... | ||
| CVE-2022-29947 | Med | 0.33 | 6.1 | 0.01 | Apr 29, 2022 | Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping. | ||
| CVE-2022-1530 | Med | 0.33 | 6.1 | 0.01 | Apr 29, 2022 | Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application. | ||
| CVE-2022-1504 | Med | 0.33 | 6.1 | 0.01 | Apr 27, 2022 | XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. | ||
| CVE-2022-26597 | Med | 0.33 | 6.1 | 0.01 | Apr 25, 2022 | Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name. | ||
| CVE-2022-26596 | Med | 0.33 | 6.1 | 0.01 | Apr 25, 2022 | Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web… | ||
| CVE-2022-27103 | Med | 0.33 | 6.1 | 0.01 | Apr 25, 2022 | element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column. | ||
| CVE-2022-1439 | Med | 0.33 | 6.1 | 0.03 | Apr 22, 2022 | Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without… | ||
| CVE-2022-29577 | Med | 0.33 | 6.1 | 0.01 | Apr 21, 2022 | OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367. | ||
| CVE-2022-28367 | Med | 0.33 | 6.1 | 0.01 | Apr 21, 2022 | OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. | ||
| CVE-2022-1187 | Med | 0.33 | 6.1 | 0.01 | Apr 19, 2022 | The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21. | ||
| CVE-2022-1091 | — | Med | 0.33 | 6.1 | 0.01 | Apr 18, 2022 | The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly… | |
| CVE-2022-26594 | Med | 0.33 | 6.1 | 0.01 | Apr 15, 2022 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder… | ||
| CVE-2022-26144 | Med | 0.33 | 6.1 | 0.01 | Apr 13, 2022 | An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed. |
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
- risk 0.33cvss 6.1epss 0.01
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
- risk 0.33cvss 6.1epss 0.01
Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/loc…
- risk 0.33cvss 6.1epss 0.01
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.
- risk 0.33cvss 6.1epss 0.01
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
- risk 0.33cvss 6.1epss 0.01
DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
- risk 0.33cvss 6.1epss 0.01
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
- risk 0.33cvss 6.1epss 0.01
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web…
- risk 0.33cvss 6.1epss 0.01
element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.
- risk 0.33cvss 6.1epss 0.03
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without…
- risk 0.33cvss 6.1epss 0.01
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
- risk 0.33cvss 6.1epss 0.01
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
- risk 0.33cvss 6.1epss 0.01
The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.
- risk 0.33cvss 6.1epss 0.01
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly…
- risk 0.33cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder…
- risk 0.33cvss 6.1epss 0.01
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.