CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1768 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-10395 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2020 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-group.php by adding a question mark (?) followed by the payload. | ||
| CVE-2020-10394 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2020 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-glossary.php by adding a question mark (?) followed by the payload. | ||
| CVE-2020-10393 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2020 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-field.php by adding a question mark (?) followed by the payload. | ||
| CVE-2020-10392 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2020 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-category.php by adding a question mark (?) followed by the payload. | ||
| CVE-2020-10391 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2020 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-article.php by adding a question mark (?) followed by the payload. | ||
| CVE-2015-7344 | Med | 0.31 | 4.8 | 0.01 | Mar 9, 2020 | HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption]. | ||
| CVE-2015-7343 | Med | 0.31 | 4.8 | 0.01 | Mar 9, 2020 | JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter. | ||
| CVE-2018-17572 | Med | 0.31 | 4.8 | 0.01 | Mar 2, 2020 | InfluxDB 0.9.5 has Reflected XSS in the Write Data module. | ||
| CVE-2018-14384 | Med | 0.31 | 4.8 | 0.01 | Mar 2, 2020 | The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter. | ||
| CVE-2020-9335 | Med | 0.31 | 4.8 | 0.01 | Feb 25, 2020 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users. | ||
| CVE-2019-12863 | Med | 0.31 | 4.8 | 0.01 | Feb 25, 2020 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. | ||
| CVE-2012-1932 | Med | 0.31 | 4.8 | 0.01 | Feb 19, 2020 | A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via the setting[admin_email] parameter to admin/setting. | ||
| CVE-2020-9038 | Med | 0.31 | 5.4 | 0.04 | Feb 17, 2020 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. | ||
| CVE-2020-8822 | Med | 0.31 | 4.8 | 0.01 | Feb 10, 2020 | Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application. | ||
| CVE-2020-5317 | Med | 0.31 | 4.8 | 0.01 | Feb 6, 2020 | Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their… | ||
| CVE-2020-3149 | Med | 0.31 | 4.8 | 0.01 | Feb 5, 2020 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input… | ||
| CVE-2019-15619 | Med | 0.31 | 4.8 | 0.01 | Feb 4, 2020 | Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project. | ||
| CVE-2019-15618 | Med | 0.31 | 4.8 | 0.01 | Feb 4, 2020 | Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. | ||
| CVE-2020-8496 | Med | 0.31 | 4.8 | 0.01 | Jan 30, 2020 | In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator. | ||
| CVE-2019-20439 | — | Med | 0.31 | 4.8 | 0.01 | Jan 28, 2020 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in the "manage the API" page of the API Publisher. |
- risk 0.31cvss 4.8epss 0.01
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-group.php by adding a question mark (?) followed by the payload.
- risk 0.31cvss 4.8epss 0.01
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-glossary.php by adding a question mark (?) followed by the payload.
- risk 0.31cvss 4.8epss 0.01
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-field.php by adding a question mark (?) followed by the payload.
- risk 0.31cvss 4.8epss 0.01
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-category.php by adding a question mark (?) followed by the payload.
- risk 0.31cvss 4.8epss 0.01
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-article.php by adding a question mark (?) followed by the payload.
- risk 0.31cvss 4.8epss 0.01
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
- risk 0.31cvss 4.8epss 0.01
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
- risk 0.31cvss 4.8epss 0.01
InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
- risk 0.31cvss 4.8epss 0.01
The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.
- risk 0.31cvss 4.8epss 0.01
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
- risk 0.31cvss 4.8epss 0.01
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.
- risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via the setting[admin_email] parameter to admin/setting.
- risk 0.31cvss 5.4epss 0.04
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
- risk 0.31cvss 4.8epss 0.01
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
- risk 0.31cvss 4.8epss 0.01
Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input…
- risk 0.31cvss 4.8epss 0.01
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
- risk 0.31cvss 4.8epss 0.01
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
- risk 0.31cvss 4.8epss 0.01
In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in the "manage the API" page of the API Publisher.