CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1657 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-7316 | Med | 0.33 | 6.1 | 0.01 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. | ||
| CVE-2015-6748 | Med | 0.33 | 6.1 | 0.02 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3. | ||
| CVE-2015-5282 | Med | 0.33 | 6.1 | 0.01 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. | ||
| CVE-2017-14726 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | ||
| CVE-2017-14724 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | ||
| CVE-2017-14721 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | ||
| CVE-2017-14720 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | ||
| CVE-2017-14718 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | ||
| CVE-2015-4706 | Med | 0.33 | 6.1 | 0.02 | Sep 21, 2017 | Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path. | ||
| CVE-2015-3296 | Med | 0.33 | 6.1 | 0.01 | Sep 21, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs. | ||
| CVE-2015-4707 | Med | 0.33 | 6.1 | 0.02 | Sep 20, 2017 | Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path. | ||
| CVE-2015-1866 | Med | 0.33 | 6.1 | 0.01 | Sep 20, 2017 | Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2. | ||
| CVE-2015-3299 | Med | 0.33 | 6.1 | 0.02 | Sep 19, 2017 | Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order. | ||
| CVE-2017-12156 | Med | 0.33 | 6.1 | 0.01 | Sep 18, 2017 | Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. | ||
| CVE-2017-14498 | Med | 0.33 | 6.1 | 0.01 | Sep 15, 2017 | SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue… | ||
| CVE-2015-8354 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2017 | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php. | ||
| CVE-2016-10508 | Med | 0.33 | 6.1 | 0.01 | Aug 31, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php. | ||
| CVE-2015-5057 | Med | 0.33 | 6.1 | 0.01 | Aug 18, 2017 | Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed. | ||
| CVE-2016-6812 | Med | 0.33 | 6.1 | 0.08 | Aug 10, 2017 | The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current… | ||
| CVE-2009-5145 | Med | 0.33 | 6.1 | 0.02 | Aug 7, 2017 | Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12. |
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
- risk 0.33cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.
- risk 0.33cvss 6.1epss 0.01
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
- risk 0.33cvss 6.1epss 0.01
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue…
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
- risk 0.33cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.
- risk 0.33cvss 6.1epss 0.08
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current…
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.