CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1775 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16138 | Med | 0.31 | 4.8 | 0.01 | May 13, 2019 | An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities. | ||
| CVE-2018-16626 | Med | 0.31 | 4.8 | 0.01 | May 13, 2019 | index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name. | ||
| CVE-2018-16625 | Med | 0.31 | 4.8 | 0.01 | May 13, 2019 | index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. | ||
| CVE-2018-16623 | Med | 0.31 | 4.8 | 0.01 | May 13, 2019 | Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown. | ||
| CVE-2018-20837 | Med | 0.31 | 4.8 | 0.01 | May 9, 2019 | include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS. | ||
| CVE-2019-1701 | Med | 0.31 | 4.8 | 0.01 | May 3, 2019 | Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal… | ||
| CVE-2018-18276 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2019 | XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel. | ||
| CVE-2018-18824 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2019 | WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/. | ||
| CVE-2018-18823 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2019 | WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/. | ||
| CVE-2019-11513 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2019 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. | ||
| CVE-2019-1802 | Med | 0.31 | 4.8 | 0.01 | Apr 18, 2019 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The… | ||
| CVE-2018-13137 | Med | 0.31 | 4.8 | 0.01 | Apr 12, 2019 | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI. | ||
| CVE-2018-19006 | Med | 0.31 | 4.8 | 0.01 | Apr 8, 2019 | OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF… | ||
| CVE-2018-1731 | Med | 0.31 | 4.8 | 0.01 | Apr 3, 2019 | IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials… | ||
| CVE-2019-1571 | Med | 0.31 | 4.8 | 0.01 | Mar 26, 2019 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings. | ||
| CVE-2019-1570 | Med | 0.31 | 4.8 | 0.01 | Mar 26, 2019 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings. | ||
| CVE-2019-1569 | Med | 0.31 | 4.8 | 0.01 | Mar 26, 2019 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user. | ||
| CVE-2019-10027 | Med | 0.31 | 4.8 | 0.01 | Mar 25, 2019 | PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen. | ||
| CVE-2018-10091 | Med | 0.31 | 4.8 | 0.01 | Mar 21, 2019 | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS. | ||
| CVE-2018-19394 | Med | 0.31 | 4.8 | 0.01 | Mar 15, 2019 | Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name),… |
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.
- risk 0.31cvss 4.8epss 0.01
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
- risk 0.31cvss 4.8epss 0.01
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- risk 0.31cvss 4.8epss 0.01
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
- risk 0.31cvss 4.8epss 0.01
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
- risk 0.31cvss 4.8epss 0.01
Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal…
- risk 0.31cvss 4.8epss 0.01
XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel.
- risk 0.31cvss 4.8epss 0.01
WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
- risk 0.31cvss 4.8epss 0.01
WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
- risk 0.31cvss 4.8epss 0.01
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The…
- risk 0.31cvss 4.8epss 0.01
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
- risk 0.31cvss 4.8epss 0.01
OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF…
- risk 0.31cvss 4.8epss 0.01
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
- risk 0.31cvss 4.8epss 0.01
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings.
- risk 0.31cvss 4.8epss 0.01
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings.
- risk 0.31cvss 4.8epss 0.01
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user.
- risk 0.31cvss 4.8epss 0.01
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
- risk 0.31cvss 4.8epss 0.01
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.
- risk 0.31cvss 4.8epss 0.01
Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name),…