CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1777 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-19600 | Med | 0.31 | 4.8 | 0.01 | Jan 3, 2019 | Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload. | ||
| CVE-2018-19902 | Med | 0.31 | 4.8 | 0.01 | Dec 31, 2018 | No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter. | ||
| CVE-2018-19901 | Med | 0.31 | 4.8 | 0.01 | Dec 31, 2018 | No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter. | ||
| CVE-2018-19844 | Med | 0.31 | 4.8 | 0.01 | Dec 31, 2018 | FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319. | ||
| CVE-2018-20601 | Med | 0.31 | 4.8 | 0.01 | Dec 30, 2018 | UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action. | ||
| CVE-2018-20597 | Med | 0.31 | 4.8 | 0.01 | Dec 30, 2018 | UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action. | ||
| CVE-2018-20590 | Med | 0.31 | 4.8 | 0.01 | Dec 30, 2018 | Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID. | ||
| CVE-2018-20589 | Med | 0.31 | 4.8 | 0.01 | Dec 30, 2018 | Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID. | ||
| CVE-2018-16632 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/. | ||
| CVE-2018-16630 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. | ||
| CVE-2018-20565 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter. | ||
| CVE-2018-20564 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter. | ||
| CVE-2018-20563 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter. | ||
| CVE-2018-20562 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter. | ||
| CVE-2018-20561 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter. | ||
| CVE-2018-20560 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter. | ||
| CVE-2018-20559 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter. | ||
| CVE-2018-20558 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter. | ||
| CVE-2018-20557 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter. | ||
| CVE-2018-1000887 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name EN" parameter. This attack appears to be exploitable if the malicious user has access to the… |
- risk 0.31cvss 4.8epss 0.01
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
- risk 0.31cvss 4.8epss 0.01
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
- risk 0.31cvss 4.8epss 0.01
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.
- risk 0.31cvss 4.8epss 0.01
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.
- risk 0.31cvss 4.8epss 0.01
UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
- risk 0.31cvss 4.8epss 0.01
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
- risk 0.31cvss 4.8epss 0.01
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID.
- risk 0.31cvss 4.8epss 0.01
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID.
- risk 0.31cvss 4.8epss 0.01
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
- risk 0.31cvss 4.8epss 0.01
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.
- risk 0.31cvss 4.8epss 0.01
Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name EN" parameter. This attack appears to be exploitable if the malicious user has access to the…