CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1770 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18273 | Med | 0.31 | 4.8 | 0.01 | Jan 15, 2020 | OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow invalid input to be introduced. | ||
| CVE-2019-12398 | Med | 0.31 | 4.8 | 0.03 | Jan 14, 2020 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected. | ||
| CVE-2019-20182 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. | ||
| CVE-2019-20181 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. | ||
| CVE-2012-5558 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a… | ||
| CVE-2019-6332 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2020 | A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS). Affected products and versions include: HP DeskJet 2600 All-in-One Printer series model numbers 4UJ28B, V1N01A -… | ||
| CVE-2014-1454 | Med | 0.31 | 4.8 | 0.01 | Jan 8, 2020 | Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input | ||
| CVE-2020-5843 | Med | 0.31 | 4.8 | 0.01 | Jan 7, 2020 | Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen. | ||
| CVE-2020-5306 | Med | 0.31 | 4.8 | 0.01 | Jan 5, 2020 | Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content. | ||
| CVE-2020-5305 | Med | 0.31 | 4.8 | 0.01 | Jan 5, 2020 | Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen. | ||
| CVE-2019-12186 | Med | 0.31 | 4.8 | 0.01 | Dec 31, 2019 | An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through… | ||
| CVE-2016-1000029 | Med | 0.31 | 4.8 | 0.01 | Dec 27, 2019 | Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269). | ||
| CVE-2016-1000028 | Med | 0.31 | 4.8 | 0.01 | Dec 27, 2019 | Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198). | ||
| CVE-2019-16781 | Med | 0.31 | 5.8 | 0.02 | Dec 26, 2019 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. | ||
| CVE-2019-16780 | Med | 0.31 | 5.8 | 0.02 | Dec 26, 2019 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an… | ||
| CVE-2019-19901 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2019 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an… | ||
| CVE-2019-19900 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2019 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an… | ||
| CVE-2019-4388 | Med | 0.31 | 4.8 | 0.01 | Dec 18, 2019 | HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI. | ||
| CVE-2019-18378 | Med | 0.31 | 4.8 | 0.01 | Dec 11, 2019 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by… | ||
| CVE-2019-15007 | Med | 0.31 | 4.8 | 0.01 | Dec 11, 2019 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch. |
- risk 0.31cvss 4.8epss 0.01
OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow invalid input to be introduced.
- risk 0.31cvss 4.8epss 0.03
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
- risk 0.31cvss 4.8epss 0.01
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
- risk 0.31cvss 4.8epss 0.01
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a…
- risk 0.31cvss 4.8epss 0.01
A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS). Affected products and versions include: HP DeskJet 2600 All-in-One Printer series model numbers 4UJ28B, V1N01A -…
- risk 0.31cvss 4.8epss 0.01
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input
- risk 0.31cvss 4.8epss 0.01
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
- risk 0.31cvss 4.8epss 0.01
Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.
- risk 0.31cvss 4.8epss 0.01
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through…
- risk 0.31cvss 4.8epss 0.01
Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).
- risk 0.31cvss 4.8epss 0.01
Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).
- risk 0.31cvss 5.8epss 0.02
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
- risk 0.31cvss 5.8epss 0.02
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an…
- risk 0.31cvss 4.8epss 0.01
HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.
- risk 0.31cvss 4.8epss 0.01
Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by…
- risk 0.31cvss 4.8epss 0.01
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.