CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1644 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17599 | Med | 0.33 | 6.1 | 0.02 | Dec 13, 2019 | The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The… | ||
| CVE-2013-4303 | Med | 0.33 | 6.1 | 0.02 | Dec 11, 2019 | includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to… | ||
| CVE-2019-10772 | Med | 0.33 | 6.1 | 0.01 | Dec 11, 2019 | It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer. | ||
| CVE-2013-7371 | Med | 0.33 | 6.1 | 0.01 | Dec 11, 2019 | node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370) | ||
| CVE-2013-7370 | Med | 0.33 | 6.1 | 0.01 | Dec 11, 2019 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware | ||
| CVE-2013-4158 | Med | 0.33 | 6.1 | 0.01 | Dec 11, 2019 | smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790) | ||
| CVE-2014-3656 | Med | 0.33 | 6.1 | 0.01 | Dec 10, 2019 | JBoss KeyCloak: XSS in login-status-iframe.html | ||
| CVE-2019-19619 | Med | 0.33 | 6.1 | 0.01 | Dec 6, 2019 | domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS. | ||
| CVE-2012-4526 | Med | 0.33 | 6.1 | 0.01 | Dec 2, 2019 | piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) | ||
| CVE-2012-4525 | Med | 0.33 | 6.1 | 0.01 | Dec 2, 2019 | piwigo has XSS in password.php | ||
| CVE-2019-16195 | Med | 0.33 | 6.1 | 0.01 | Nov 26, 2019 | Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields. | ||
| CVE-2011-4924 | Med | 0.33 | 6.1 | 0.01 | Nov 25, 2019 | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way… | ||
| CVE-2013-2092 | Med | 0.33 | 6.1 | 0.01 | Nov 20, 2019 | Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. | ||
| CVE-2012-4441 | Med | 0.33 | 6.1 | 0.02 | Nov 18, 2019 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin. | ||
| CVE-2012-4440 | Med | 0.33 | 6.1 | 0.02 | Nov 18, 2019 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin. | ||
| CVE-2019-18982 | Med | 0.33 | 6.1 | 0.01 | Nov 15, 2019 | bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header. | ||
| CVE-2019-18923 | Med | 0.33 | 6.1 | 0.01 | Nov 13, 2019 | Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin. | ||
| CVE-2011-2935 | Med | 0.33 | 6.1 | 0.01 | Nov 12, 2019 | Elgg through 1.7.10 has XSS | ||
| CVE-2019-10219 | Med | 0.33 | 6.1 | 0.02 | Nov 8, 2019 | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. | ||
| CVE-2013-1426 | Med | 0.33 | 6.1 | 0.01 | Nov 7, 2019 | Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor. |
- risk 0.33cvss 6.1epss 0.02
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The…
- risk 0.33cvss 6.1epss 0.02
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to…
- risk 0.33cvss 6.1epss 0.01
It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
- risk 0.33cvss 6.1epss 0.01
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
- risk 0.33cvss 6.1epss 0.01
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
- risk 0.33cvss 6.1epss 0.01
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
- risk 0.33cvss 6.1epss 0.01
JBoss KeyCloak: XSS in login-status-iframe.html
- risk 0.33cvss 6.1epss 0.01
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
- risk 0.33cvss 6.1epss 0.01
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
- risk 0.33cvss 6.1epss 0.01
piwigo has XSS in password.php
- risk 0.33cvss 6.1epss 0.01
Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way…
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
- risk 0.33cvss 6.1epss 0.02
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
- risk 0.33cvss 6.1epss 0.02
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.
- risk 0.33cvss 6.1epss 0.01
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
- risk 0.33cvss 6.1epss 0.01
Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin.
- risk 0.33cvss 6.1epss 0.01
Elgg through 1.7.10 has XSS
- risk 0.33cvss 6.1epss 0.02
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
- risk 0.33cvss 6.1epss 0.01
Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.