CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1638 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-43324 | Med | 0.33 | 6.1 | 0.01 | Nov 3, 2021 | LibreNMS through 21.10.2 allows XSS via a widget title. | ||
| CVE-2021-41169 | Med | 0.33 | 6.2 | 0.01 | Oct 21, 2021 | Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised… | ||
| CVE-2021-25969 | Med | 0.33 | 6.1 | 0.01 | Oct 20, 2021 | In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the… | ||
| CVE-2011-1497 | Med | 0.33 | 6.1 | 0.01 | Oct 19, 2021 | A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6. | ||
| CVE-2021-3863 | Med | 0.33 | 6.1 | 0.01 | Oct 19, 2021 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-42134 | Med | 0.33 | 6.1 | 0.01 | Oct 11, 2021 | The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053. | ||
| CVE-2021-42112 | Med | 0.33 | 6.1 | 0.02 | Oct 8, 2021 | The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js. | ||
| CVE-2021-21684 | Med | 0.33 | 6.1 | 0.01 | Oct 6, 2021 | Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability. | ||
| CVE-2021-25963 | Med | 0.33 | 6.1 | 0.01 | Sep 30, 2021 | In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped. | ||
| CVE-2021-25959 | Med | 0.33 | 6.1 | 0.01 | Sep 29, 2021 | In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance. | ||
| CVE-2021-3783 | Med | 0.33 | 6.1 | 0.01 | Sep 15, 2021 | yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-3780 | Med | 0.33 | 6.1 | 0.01 | Sep 15, 2021 | peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-39286 | Med | 0.33 | 6.1 | 0.01 | Aug 18, 2021 | Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped. | ||
| CVE-2021-38186 | Med | 0.33 | 6.1 | 0.01 | Aug 8, 2021 | An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities. | ||
| CVE-2020-22330 | Med | 0.33 | 6.1 | 0.01 | Aug 6, 2021 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. | ||
| CVE-2021-35463 | Med | 0.33 | 6.1 | 0.01 | Aug 4, 2021 | Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. | ||
| CVE-2021-33337 | Med | 0.33 | 6.1 | 0.01 | Aug 4, 2021 | Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the… | ||
| CVE-2021-33326 | Med | 0.33 | 6.1 | 0.01 | Aug 3, 2021 | Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a… | ||
| CVE-2021-37916 | Med | 0.33 | 6.1 | 0.01 | Aug 3, 2021 | Joplin before 2.0.9 allows XSS via button and form in the note body. | ||
| CVE-2021-34630 | Med | 0.33 | 5.0 | 0.02 | Jul 30, 2021 | In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this… |
- risk 0.33cvss 6.1epss 0.01
LibreNMS through 21.10.2 allows XSS via a widget title.
- risk 0.33cvss 6.2epss 0.01
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised…
- risk 0.33cvss 6.1epss 0.01
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the…
- risk 0.33cvss 6.1epss 0.01
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
- risk 0.33cvss 6.1epss 0.01
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.33cvss 6.1epss 0.01
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
- risk 0.33cvss 6.1epss 0.02
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
- risk 0.33cvss 6.1epss 0.01
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- risk 0.33cvss 6.1epss 0.01
In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
- risk 0.33cvss 6.1epss 0.01
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
- risk 0.33cvss 6.1epss 0.01
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.33cvss 6.1epss 0.01
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.33cvss 6.1epss 0.01
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
- risk 0.33cvss 6.1epss 0.01
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the…
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a…
- risk 0.33cvss 6.1epss 0.01
Joplin before 2.0.9 allows XSS via button and form in the note body.
- risk 0.33cvss 5.0epss 0.02
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this…