CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1772 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16522 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the… | ||
| CVE-2019-17630 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | ||
| CVE-2019-17629 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | ||
| CVE-2019-17522 | Med | 0.31 | 4.8 | 0.01 | Oct 12, 2019 | A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1. | ||
| CVE-2015-9469 | Med | 0.31 | 4.8 | 0.01 | Oct 10, 2019 | The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. | ||
| CVE-2019-17433 | Med | 0.31 | 4.8 | 0.01 | Oct 10, 2019 | z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen. | ||
| CVE-2019-17417 | Med | 0.31 | 4.8 | 0.01 | Oct 10, 2019 | PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs. | ||
| CVE-2019-17226 | Med | 0.31 | 4.8 | 0.01 | Oct 6, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | ||
| CVE-2019-4106 | Med | 0.31 | 4.8 | 0.01 | Sep 30, 2019 | IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.… | ||
| CVE-2019-16684 | Med | 0.31 | 4.8 | 0.01 | Sep 30, 2019 | An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes. | ||
| CVE-2019-16683 | Med | 0.31 | 4.8 | 0.01 | Sep 30, 2019 | An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes. | ||
| CVE-2019-17045 | Med | 0.31 | 4.8 | 0.01 | Sep 30, 2019 | Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab. | ||
| CVE-2019-3747 | Med | 0.31 | 4.8 | 0.01 | Sep 27, 2019 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field.… | ||
| CVE-2019-16524 | Med | 0.31 | 4.8 | 0.01 | Sep 26, 2019 | The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output… | ||
| CVE-2015-9439 | Med | 0.31 | 4.8 | 0.01 | Sep 26, 2019 | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter. | ||
| CVE-2019-12668 | Med | 0.31 | 4.8 | 0.01 | Sep 25, 2019 | A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software using the banner parameter. The… | ||
| CVE-2019-12667 | Med | 0.31 | 4.8 | 0.01 | Sep 25, 2019 | A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input… | ||
| CVE-2019-16704 | Med | 0.31 | 4.8 | 0.01 | Sep 23, 2019 | admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS. | ||
| CVE-2019-16681 | Med | 0.31 | 4.7 | 0.01 | Sep 21, 2019 | The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also… | ||
| CVE-2019-16664 | Med | 0.31 | 4.8 | 0.01 | Sep 21, 2019 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter. |
- risk 0.31cvss 4.8epss 0.01
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the…
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
- risk 0.31cvss 4.8epss 0.01
A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.
- risk 0.31cvss 4.8epss 0.01
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
- risk 0.31cvss 4.8epss 0.01
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
- risk 0.31cvss 4.8epss 0.01
PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
- risk 0.31cvss 4.8epss 0.01
IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes.
- risk 0.31cvss 4.8epss 0.01
Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.
- risk 0.31cvss 4.8epss 0.01
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field.…
- risk 0.31cvss 4.8epss 0.01
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output…
- risk 0.31cvss 4.8epss 0.01
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software using the banner parameter. The…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input…
- risk 0.31cvss 4.8epss 0.01
admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
- risk 0.31cvss 4.7epss 0.01
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.