CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1712 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-11711 | Med | 0.31 | 4.8 | 0.00 | Aug 25, 2023 | An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin… | ||
| CVE-2023-39521 | Med | 0.31 | 4.8 | 0.01 | Aug 24, 2023 | Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the… | ||
| CVE-2023-36317 | Med | 0.31 | 4.8 | 0.01 | Aug 23, 2023 | Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL. | ||
| CVE-2023-31942 | Med | 0.31 | 4.8 | 0.01 | Aug 17, 2023 | Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the description parameter in insert.php. | ||
| CVE-2023-34412 | Med | 0.31 | 4.8 | 0.00 | Aug 17, 2023 | A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS). | ||
| CVE-2023-40281 | Med | 0.31 | 4.8 | 0.00 | Aug 17, 2023 | EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed… | ||
| CVE-2023-20222 | Med | 0.31 | 4.8 | 0.00 | Aug 16, 2023 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected… | ||
| CVE-2023-20201 | Med | 0.31 | 4.8 | 0.00 | Aug 16, 2023 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface… | ||
| CVE-2023-20242 | Med | 0.31 | 4.8 | 0.00 | Aug 16, 2023 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an… | ||
| CVE-2023-2254 | Med | 0.31 | 4.8 | 0.00 | Aug 16, 2023 | The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we… | ||
| CVE-2023-3721 | Med | 0.31 | 4.8 | 0.00 | Aug 14, 2023 | The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite… | ||
| CVE-2023-37070 | Med | 0.31 | 4.8 | 0.01 | Aug 14, 2023 | Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS) | ||
| CVE-2023-3937 | Med | 0.31 | 4.8 | 0.00 | Aug 11, 2023 | Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser | ||
| CVE-2022-44629 | Med | 0.31 | 4.8 | 0.00 | Aug 10, 2023 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions. | ||
| CVE-2023-26961 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request. | ||
| CVE-2023-37690 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Search Maid page. | ||
| CVE-2023-37689 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking Request page. | ||
| CVE-2023-37688 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page. | ||
| CVE-2023-37686 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Nurse Page in the Admin portal. | ||
| CVE-2023-37685 | Med | 0.31 | 4.8 | 0.00 | Aug 8, 2023 | Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Page of the Admin portal. |
- risk 0.31cvss 4.8epss 0.00
An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin…
- risk 0.31cvss 4.8epss 0.01
Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the…
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL.
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the description parameter in insert.php.
- risk 0.31cvss 4.8epss 0.00
A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
- risk 0.31cvss 4.8epss 0.00
EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed…
- risk 0.31cvss 4.8epss 0.00
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected…
- risk 0.31cvss 4.8epss 0.00
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface…
- risk 0.31cvss 4.8epss 0.00
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an…
- risk 0.31cvss 4.8epss 0.00
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we…
- risk 0.31cvss 4.8epss 0.00
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite…
- risk 0.31cvss 4.8epss 0.01
Code Projects Hospital Information System 1.0 is vulnerable to Cross Site Scripting (XSS)
- risk 0.31cvss 4.8epss 0.00
Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser
- risk 0.31cvss 4.8epss 0.00
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
- risk 0.31cvss 4.8epss 0.00
Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.
- risk 0.31cvss 4.8epss 0.00
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Search Maid page.
- risk 0.31cvss 4.8epss 0.00
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking Request page.
- risk 0.31cvss 4.8epss 0.00
Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page.
- risk 0.31cvss 4.8epss 0.00
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Nurse Page in the Admin portal.
- risk 0.31cvss 4.8epss 0.00
Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Page of the Admin portal.