CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1759 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-5585 | Med | 0.31 | 4.8 | 0.01 | Jun 30, 2020 | Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors. | ||
| CVE-2019-20416 | Med | 0.31 | 4.8 | 0.01 | Jun 30, 2020 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0. | ||
| CVE-2020-13423 | Med | 0.31 | 4.8 | 0.01 | Jun 29, 2020 | Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email field, or the User-Agent HTTP header. | ||
| CVE-2020-9437 | Med | 0.31 | 4.8 | 0.01 | Jun 25, 2020 | SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS. | ||
| CVE-2020-15041 | Med | 0.31 | 4.8 | 0.01 | Jun 24, 2020 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. | ||
| CVE-2020-14965 | Med | 0.31 | 4.8 | 0.01 | Jun 23, 2020 | On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also… | ||
| CVE-2020-14927 | Med | 0.31 | 4.8 | 0.01 | Jun 19, 2020 | Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen. | ||
| CVE-2020-3355 | Med | 0.31 | 4.8 | 0.01 | Jun 18, 2020 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is… | ||
| CVE-2020-3354 | Med | 0.31 | 4.8 | 0.01 | Jun 18, 2020 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is… | ||
| CVE-2019-19110 | Med | 0.31 | 4.8 | 0.01 | Jun 15, 2020 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. | ||
| CVE-2020-13980 | Med | 0.31 | 4.8 | 0.01 | Jun 9, 2020 | OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a… | ||
| CVE-2020-13660 | Med | 0.31 | 4.8 | 0.01 | May 28, 2020 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | ||
| CVE-2020-13487 | Med | 0.31 | 4.8 | 0.02 | May 26, 2020 | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit… | ||
| CVE-2020-13225 | Med | 0.31 | 4.8 | 0.01 | May 20, 2020 | phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget. | ||
| CVE-2020-5838 | Med | 0.31 | 4.8 | 0.01 | May 13, 2020 | Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users. | ||
| CVE-2020-9314 | Med | 0.31 | 4.8 | 0.01 | May 10, 2020 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy… | ||
| CVE-2020-8799 | Med | 0.31 | 4.8 | 0.01 | May 5, 2020 | A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website. | ||
| CVE-2020-11029 | Med | 0.31 | 5.8 | 0.02 | Apr 30, 2020 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release… | ||
| CVE-2020-11025 | Med | 0.31 | 5.8 | 0.02 | Apr 30, 2020 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously… | ||
| CVE-2020-12276 | Med | 0.31 | 4.8 | 0.01 | Apr 29, 2020 | GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature. |
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script via unspecified vectors.
- risk 0.31cvss 4.8epss 0.01
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0.
- risk 0.31cvss 4.8epss 0.01
Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email field, or the User-Agent HTTP header.
- risk 0.31cvss 4.8epss 0.01
SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS.
- risk 0.31cvss 4.8epss 0.01
PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field.
- risk 0.31cvss 4.8epss 0.01
On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also…
- risk 0.31cvss 4.8epss 0.01
Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the "Web Sites > Create > Aliases > Add" screen.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is…
- risk 0.31cvss 4.8epss 0.01
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
- risk 0.31cvss 4.8epss 0.01
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a…
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
- risk 0.31cvss 4.8epss 0.02
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit…
- risk 0.31cvss 4.8epss 0.01
phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.
- risk 0.31cvss 4.8epss 0.01
Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users.
- risk 0.31cvss 4.8epss 0.01
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy…
- risk 0.31cvss 4.8epss 0.01
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
- risk 0.31cvss 5.8epss 0.02
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release…
- risk 0.31cvss 5.8epss 0.02
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously…
- risk 0.31cvss 4.8epss 0.01
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.