CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1776 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-9751 | Med | 0.31 | 4.8 | 0.01 | Mar 13, 2019 | An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to… | ||
| CVE-2019-9661 | Med | 0.31 | 4.8 | 0.01 | Mar 11, 2019 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, | ||
| CVE-2019-9660 | Med | 0.31 | 4.8 | 0.01 | Mar 11, 2019 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. | ||
| CVE-2019-8440 | Med | 0.31 | 4.8 | 0.01 | Mar 7, 2019 | An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/index.php, aka site_logo. | ||
| CVE-2019-8438 | Med | 0.31 | 4.8 | 0.01 | Mar 7, 2019 | An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka site_name. | ||
| CVE-2019-9570 | Med | 0.31 | 4.8 | 0.01 | Mar 5, 2019 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. | ||
| CVE-2017-15515 | Med | 0.31 | 4.8 | 0.01 | Mar 4, 2019 | NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into the custom secondary policy label field. | ||
| CVE-2019-9551 | Med | 0.31 | 4.8 | 0.01 | Mar 4, 2019 | An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS. | ||
| CVE-2019-9550 | Med | 0.31 | 4.8 | 0.01 | Mar 3, 2019 | DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS. | ||
| CVE-2019-1665 | Med | 0.31 | 4.7 | 0.01 | Feb 21, 2019 | A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due… | ||
| CVE-2018-20240 | Med | 0.31 | 4.8 | 0.01 | Feb 20, 2019 | The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter. | ||
| CVE-2019-8435 | Med | 0.31 | 4.8 | 0.01 | Feb 18, 2019 | admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. | ||
| CVE-2019-7547 | Med | 0.31 | 4.8 | 0.01 | Feb 6, 2019 | An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to stored XSS. | ||
| CVE-2019-7345 | Med | 0.31 | 4.8 | 0.01 | Feb 4, 2019 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BANNER value, allowing an attacker to execute HTML or JavaScript code. This… | ||
| CVE-2019-7337 | Med | 0.31 | 4.8 | 0.01 | Feb 4, 2019 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which… | ||
| CVE-2018-20725 | Med | 0.31 | 4.8 | 0.01 | Jan 16, 2019 | A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label. | ||
| CVE-2018-20724 | Med | 0.31 | 4.8 | 0.01 | Jan 16, 2019 | A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors. | ||
| CVE-2018-20723 | Med | 0.31 | 4.8 | 0.01 | Jan 16, 2019 | A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color. | ||
| CVE-2018-16204 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2019 | Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-20680 | Med | 0.31 | 4.8 | 0.01 | Jan 9, 2019 | Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field. |
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to…
- risk 0.31cvss 4.8epss 0.01
Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter,
- risk 0.31cvss 4.8epss 0.01
Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/index.php, aka site_logo.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka site_name.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter.
- risk 0.31cvss 4.8epss 0.01
NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into the custom secondary policy label field.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.
- risk 0.31cvss 4.8epss 0.01
DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.
- risk 0.31cvss 4.7epss 0.01
A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due…
- risk 0.31cvss 4.8epss 0.01
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
- risk 0.31cvss 4.8epss 0.01
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to stored XSS.
- risk 0.31cvss 4.8epss 0.01
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, HOME_URL, HOME_CONTENT, or WEB_CONSOLE_BANNER value, allowing an attacker to execute HTML or JavaScript code. This…
- risk 0.31cvss 4.8epss 0.01
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which…
- risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.
- risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
- risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.