CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 1780 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-18741 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing. | ||
| CVE-2018-18740 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI. | ||
| CVE-2018-18739 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field. | ||
| CVE-2018-18738 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter. | ||
| CVE-2018-18726 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5. | ||
| CVE-2018-18725 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5. | ||
| CVE-2018-18724 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5. | ||
| CVE-2018-18723 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5. | ||
| CVE-2018-18722 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5. | ||
| CVE-2018-18721 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5. | ||
| CVE-2018-18720 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5. | ||
| CVE-2018-18717 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI. | ||
| CVE-2018-18694 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases. | ||
| CVE-2018-18517 | Med | 0.31 | 4.8 | 0.01 | Oct 24, 2018 | Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS. | ||
| CVE-2018-0388 | Med | 0.31 | 4.8 | 0.01 | Oct 17, 2018 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to… | ||
| CVE-2018-18433 | Med | 0.31 | 4.8 | 0.01 | Oct 17, 2018 | An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI. | ||
| CVE-2018-18431 | Med | 0.31 | 4.8 | 0.01 | Oct 17, 2018 | An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI. | ||
| CVE-2018-18430 | Med | 0.31 | 4.8 | 0.01 | Oct 17, 2018 | An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI. | ||
| CVE-2018-18290 | Med | 0.31 | 4.8 | 0.01 | Oct 14, 2018 | An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html&name=home_content allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality | ||
| CVE-2018-15426 | Med | 0.31 | 4.8 | 0.01 | Oct 5, 2018 | A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient… |
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI.
- risk 0.31cvss 4.8epss 0.01
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
- risk 0.31cvss 4.8epss 0.01
Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html&name=home_content allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient…