CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1778 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-20379 | Med | 0.31 | 4.7 | 0.01 | Dec 23, 2018 | Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-160428a devices allow XSS via a Cross Protocol Injection attack with setSSID of 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.1.1.3.10001. | ||
| CVE-2018-8891 | Med | 0.31 | 4.8 | 0.01 | Dec 20, 2018 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. | ||
| CVE-2018-8888 | Med | 0.31 | 4.8 | 0.01 | Dec 20, 2018 | A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. | ||
| CVE-2018-1000860 | Med | 0.31 | 4.7 | 0.01 | Dec 20, 2018 | phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'>quqtl… | ||
| CVE-2018-1000856 | Med | 0.31 | 4.8 | 0.01 | Dec 20, 2018 | DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page.… | ||
| CVE-2018-1000813 | Med | 0.31 | 4.8 | 0.01 | Dec 20, 2018 | Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user… | ||
| CVE-2018-19598 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request. | ||
| CVE-2018-19597 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. | ||
| CVE-2018-19596 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506. | ||
| CVE-2018-19508 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI. | ||
| CVE-2018-19507 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI. | ||
| CVE-2018-19506 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI. | ||
| CVE-2018-20137 | Med | 0.31 | 4.8 | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | ||
| CVE-2018-20136 | Med | 0.31 | 4.8 | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. | ||
| CVE-2018-20017 | Med | 0.31 | 4.8 | 0.01 | Dec 10, 2018 | SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI. | ||
| CVE-2018-20012 | Med | 0.31 | 4.8 | 0.01 | Dec 10, 2018 | PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI. | ||
| CVE-2018-19927 | Med | 0.31 | 4.8 | 0.01 | Dec 6, 2018 | Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases. | ||
| CVE-2018-19919 | Med | 0.31 | 4.8 | 0.01 | Dec 6, 2018 | Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element. | ||
| CVE-2018-19892 | Med | 0.31 | 4.8 | 0.02 | Dec 6, 2018 | DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field. | ||
| CVE-2018-19849 | Med | 0.31 | 4.8 | 0.00 | Dec 4, 2018 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. |
- risk 0.31cvss 4.7epss 0.01
Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-160428a devices allow XSS via a Cross Protocol Injection attack with setSSID of 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.1.1.3.10001.
- risk 0.31cvss 4.8epss 0.01
Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
- risk 0.31cvss 4.8epss 0.01
A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator.
- risk 0.31cvss 4.7epss 0.01
phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'>quqtl…
- risk 0.31cvss 4.8epss 0.01
DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page.…
- risk 0.31cvss 4.8epss 0.01
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user…
- risk 0.31cvss 4.8epss 0.01
Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
- risk 0.31cvss 4.8epss 0.01
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
- risk 0.31cvss 4.8epss 0.01
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.
- risk 0.31cvss 4.8epss 0.01
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.
- risk 0.31cvss 4.8epss 0.01
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.
- risk 0.31cvss 4.8epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
- risk 0.31cvss 4.8epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.
- risk 0.31cvss 4.8epss 0.01
SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.
- risk 0.31cvss 4.8epss 0.01
PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
- risk 0.31cvss 4.8epss 0.01
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.
- risk 0.31cvss 4.8epss 0.01
Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element.
- risk 0.31cvss 4.8epss 0.02
DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
- risk 0.31cvss 4.8epss 0.00
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter.