CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1648 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16218 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in stored comments. | ||
| CVE-2019-16217 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | ||
| CVE-2017-18611 | Med | 0.33 | 6.1 | 0.01 | Sep 10, 2019 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | ||
| CVE-2017-18610 | Med | 0.33 | 6.1 | 0.01 | Sep 10, 2019 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | ||
| CVE-2017-18609 | Med | 0.33 | 6.1 | 0.01 | Sep 10, 2019 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | ||
| CVE-2019-16182 | Med | 0.33 | 6.1 | 0.01 | Sep 9, 2019 | A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files. | ||
| CVE-2019-16147 | Med | 0.33 | 6.1 | 0.01 | Sep 9, 2019 | Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. | ||
| CVE-2019-16145 | Med | 0.33 | 6.1 | 0.01 | Sep 9, 2019 | The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption. | ||
| CVE-2019-6784 | Med | 0.33 | 6.1 | 0.01 | Sep 9, 2019 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a… | ||
| CVE-2019-13209 | Med | 0.33 | 6.1 | 0.01 | Sep 4, 2019 | Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the… | ||
| CVE-2019-15782 | Med | 0.33 | 6.1 | 0.01 | Aug 29, 2019 | WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name. | ||
| CVE-2019-15479 | Med | 0.33 | 6.1 | 0.01 | Aug 26, 2019 | Status Board 1.1.81 has reflected XSS via dashboard.ts. | ||
| CVE-2019-15532 | Med | 0.33 | 6.1 | 0.01 | Aug 26, 2019 | CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. | ||
| CVE-2019-15489 | Med | 0.33 | 6.1 | 0.01 | Aug 26, 2019 | laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS. | ||
| CVE-2019-15486 | Med | 0.33 | 6.1 | 0.01 | Aug 23, 2019 | django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline. | ||
| CVE-2019-15477 | Med | 0.33 | 6.1 | 0.01 | Aug 23, 2019 | Jooby before 1.6.4 has XSS via the default error handler. | ||
| CVE-2016-10891 | Med | 0.33 | 6.1 | 0.01 | Aug 21, 2019 | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. | ||
| CVE-2016-10890 | Med | 0.33 | 6.1 | 0.01 | Aug 21, 2019 | The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. | ||
| CVE-2017-18531 | Med | 0.33 | 6.1 | 0.01 | Aug 20, 2019 | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. | ||
| CVE-2016-10893 | Med | 0.33 | 6.1 | 0.02 | Aug 20, 2019 | The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests. |
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in stored comments.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
- risk 0.33cvss 6.1epss 0.01
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
- risk 0.33cvss 6.1epss 0.01
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
- risk 0.33cvss 6.1epss 0.01
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
- risk 0.33cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
- risk 0.33cvss 6.1epss 0.01
Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
- risk 0.33cvss 6.1epss 0.01
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
- risk 0.33cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a…
- risk 0.33cvss 6.1epss 0.01
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the…
- risk 0.33cvss 6.1epss 0.01
WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.
- risk 0.33cvss 6.1epss 0.01
Status Board 1.1.81 has reflected XSS via dashboard.ts.
- risk 0.33cvss 6.1epss 0.01
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
- risk 0.33cvss 6.1epss 0.01
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
- risk 0.33cvss 6.1epss 0.01
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
- risk 0.33cvss 6.1epss 0.01
Jooby before 1.6.4 has XSS via the default error handler.
- risk 0.33cvss 6.1epss 0.01
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
- risk 0.33cvss 6.1epss 0.01
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
- risk 0.33cvss 6.1epss 0.01
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
- risk 0.33cvss 6.1epss 0.02
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.