CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1658 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-12648 | Med | 0.33 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL. | ||
| CVE-2017-12647 | Med | 0.33 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title. | ||
| CVE-2017-12646 | Med | 0.33 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address. | ||
| CVE-2017-12645 | Med | 0.33 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId. | ||
| CVE-2016-10404 | Med | 0.33 | 6.1 | 0.01 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp. | ||
| CVE-2017-12062 | Med | 0.33 | 6.1 | 0.04 | Aug 1, 2017 | An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled. | ||
| CVE-2017-12061 | Med | 0.33 | 6.1 | 0.03 | Aug 1, 2017 | An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code,… | ||
| CVE-2016-5394 | Med | 0.33 | 6.1 | 0.03 | Jul 19, 2017 | In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities. | ||
| CVE-2016-1000220 | Med | 0.33 | 6.1 | 0.01 | Jun 16, 2017 | Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. | ||
| CVE-2015-5381 | Med | 0.33 | 6.1 | 0.03 | May 23, 2017 | Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI. | ||
| CVE-2017-9063 | Med | 0.33 | 6.1 | 0.02 | May 18, 2017 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. | ||
| CVE-2017-9061 | Med | 0.33 | 6.1 | 0.02 | May 18, 2017 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. | ||
| CVE-2016-4855 | Med | 0.33 | 6.1 | 0.02 | May 12, 2017 | Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2017-8052 | Med | 0.33 | 6.1 | 0.01 | Apr 22, 2017 | Craft CMS before 2.6.2974 allows XSS attacks. | ||
| CVE-2017-7897 | Med | 0.33 | 6.1 | 0.02 | Apr 18, 2017 | A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted… | ||
| CVE-2015-8864 | Med | 0.33 | 6.1 | 0.03 | Apr 13, 2017 | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068. | ||
| CVE-2017-7391 | Med | 0.33 | 6.1 | 0.08 | Apr 1, 2017 | A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a… | ||
| CVE-2017-7390 | Med | 0.33 | 6.1 | 0.01 | Apr 1, 2017 | A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script… | ||
| CVE-2017-7271 | Med | 0.33 | 6.1 | 0.01 | Mar 27, 2017 | Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen. | ||
| CVE-2017-2644 | Med | 0.33 | 6.1 | 0.01 | Mar 26, 2017 | In Moodle 3.x, XSS can occur via evidence of prior learning. |
- risk 0.33cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
- risk 0.33cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
- risk 0.33cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
- risk 0.33cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
- risk 0.33cvss 6.1epss 0.01
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
- risk 0.33cvss 6.1epss 0.04
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
- risk 0.33cvss 6.1epss 0.03
An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code,…
- risk 0.33cvss 6.1epss 0.03
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
- risk 0.33cvss 6.1epss 0.01
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
- risk 0.33cvss 6.1epss 0.03
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
- risk 0.33cvss 6.1epss 0.02
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
- risk 0.33cvss 6.1epss 0.02
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.33cvss 6.1epss 0.01
Craft CMS before 2.6.2974 allows XSS attacks.
- risk 0.33cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted…
- risk 0.33cvss 6.1epss 0.03
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
- risk 0.33cvss 6.1epss 0.08
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a…
- risk 0.33cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrary HTML and script…
- risk 0.33cvss 6.1epss 0.01
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
- risk 0.33cvss 6.1epss 0.01
In Moodle 3.x, XSS can occur via evidence of prior learning.