CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1779 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-13351 | Med | 0.31 | 4.8 | 0.01 | Nov 27, 2018 | Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form. | ||
| CVE-2018-17256 | Med | 0.31 | 4.8 | 0.01 | Nov 27, 2018 | Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content. | ||
| CVE-2018-19464 | Med | 0.31 | 4.8 | 0.01 | Nov 22, 2018 | Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code. | ||
| CVE-2018-0679 | Med | 0.31 | 4.8 | 0.01 | Nov 15, 2018 | Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to… | ||
| CVE-2018-19223 | Med | 0.31 | 4.8 | 0.01 | Nov 12, 2018 | An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI. | ||
| CVE-2018-19170 | Med | 0.31 | 4.8 | 0.01 | Nov 11, 2018 | In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter. | ||
| CVE-2018-19142 | Med | 0.31 | 4.8 | 0.01 | Nov 11, 2018 | Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL. | ||
| CVE-2018-19141 | Med | 0.31 | 4.8 | 0.01 | Nov 11, 2018 | Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled. | ||
| CVE-2018-15393 | Med | 0.31 | 4.8 | 0.01 | Nov 8, 2018 | A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The… | ||
| CVE-2018-18952 | Med | 0.31 | 4.8 | 0.01 | Nov 5, 2018 | JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI. | ||
| CVE-2018-18943 | Med | 0.31 | 4.8 | 0.01 | Nov 5, 2018 | An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI. | ||
| CVE-2018-18939 | Med | 0.31 | 4.8 | 0.01 | Nov 5, 2018 | An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field. | ||
| CVE-2018-18938 | Med | 0.31 | 4.8 | 0.01 | Nov 5, 2018 | An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field. | ||
| CVE-2018-18927 | Med | 0.31 | 4.8 | 0.01 | Nov 4, 2018 | An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement. | ||
| CVE-2018-18919 | Med | 0.31 | 4.8 | 0.01 | Nov 4, 2018 | The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area. | ||
| CVE-2018-10586 | Med | 0.31 | 4.8 | 0.01 | Nov 1, 2018 | NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12. | ||
| CVE-2018-18841 | Med | 0.31 | 4.8 | 0.01 | Oct 30, 2018 | XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter. | ||
| CVE-2018-18745 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing. | ||
| CVE-2018-18744 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI. | ||
| CVE-2018-18743 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI. |
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form.
- risk 0.31cvss 4.8epss 0.01
Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.
- risk 0.31cvss 4.8epss 0.01
Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in multiple FXC Inc. network devices (Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.
- risk 0.31cvss 4.8epss 0.01
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
- risk 0.31cvss 4.8epss 0.01
Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.
- risk 0.31cvss 4.8epss 0.01
Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The…
- risk 0.31cvss 4.8epss 0.01
JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement.
- risk 0.31cvss 4.8epss 0.01
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.
- risk 0.31cvss 4.8epss 0.01
NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12.
- risk 0.31cvss 4.8epss 0.01
XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.